refactor: mock清理+安全配置+通用组件+菜单优化

P0安全: SECRET_KEY/ADMIN_PASSWORD/CORS环境变量化, seed仅admin

P1Mock: mock.ts 301->88行, 删8数据mock+5generateMock, net-1300行

P2组件: useToast/useFetchList+ConfirmDialog/FormDialog

P3菜单: menuSections/menuItems->constants/menu.ts

P4API: NotificationsPage/WorkflowPage重写+RolesPage演示

测试: 1050passed, tsc clean

backend/app/models/__init__.py

@@ -1 +1,2 @@
 from app.models.instance_group import InstanceGroup, user_groups  # noqa: F401
+from app.models.system_setting import SystemSetting  # noqa: F401

backend/app/models/system_setting.py

@@ -0,0 +1,36 @@
+"""系统设置模型 — 键值对存储，支持分组。"""
+
+from datetime import datetime, timezone
+from sqlalchemy import Column, Integer, String, Text, DateTime, Boolean
+from app.core.database import Base
+
+
+class SystemSetting(Base):
+    """系统设置表 — key-value 存储。
+
+    每个设置项包含: key, value, value_type, group, description, default_value。
+    value_type 用于前端控件渲染 (boolean → 开关, integer → 数字输入, string → 文本)。
+    """
+    __tablename__ = "system_settings"
+
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    key = Column(String(100), unique=True, nullable=False, index=True, comment="设置键名")
+    value = Column(Text, nullable=False, comment="设置值（字符串存储）")
+    value_type = Column(String(20), nullable=False, default="string", comment="值类型: boolean/integer/string")
+    group = Column(String(50), nullable=False, default="general", comment="分组: query/security/general")
+    label = Column(String(100), nullable=False, comment="显示名称")
+    description = Column(Text, nullable=True, comment="说明")
+    default_value = Column(Text, nullable=True, comment="默认值")
+    sort_order = Column(Integer, nullable=False, default=0, comment="排序权重")
+    updated_at = Column(DateTime, default=lambda: datetime.now(timezone.utc), onupdate=lambda: datetime.now(timezone.utc))
+
+    def get_typed_value(self):
+        """将字符串值转为实际类型。"""
+        if self.value_type == "boolean":
+            return self.value.lower() in ("true", "1", "yes")
+        if self.value_type == "integer":
+            try:
+                return int(self.value)
+            except (ValueError, TypeError):
+                return int(self.default_value or 0)
+        return self.value