fix(security): 收紧 MCP 数据权限并移除默认凭据

xiaoqu-agent-service/src/main/resources/application-dev.yml

@@ -1,33 +1,33 @@
 # dev 环境：内网 192.168.1.181（沿用 xiaoqu-franchisee pom.xml dev profile）
-# 密码走环境变量占位符，默认值仅供本地 dev 使用
+# 账号和密码必须由环境变量提供；m0/m1/m2 应使用数据库只读账号
 app:
   datasource:
     m0: # 权限库 xiaoqu_comples_d（user/agent/authority/propery/agent_manage_district_auth）
       driver-class-name: com.mysql.cj.jdbc.Driver
       jdbc-url: jdbc:mysql://192.168.1.181:3306/xiaoqu_comples_d?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
-      username: root
-      password: ${M0_DB_PASSWORD:kaixinjiuhao}
+      username: ${M0_DB_USERNAME}
+      password: ${M0_DB_PASSWORD}
     m1: # 商城库 xiaoqu_mall_d（按需启用）
       driver-class-name: com.mysql.cj.jdbc.Driver
       jdbc-url: jdbc:mysql://192.168.1.181:3306/xiaoqu_mall_d?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
-      username: root
-      password: ${M1_DB_PASSWORD:kaixinjiuhao}
+      username: ${M1_DB_USERNAME}
+      password: ${M1_DB_PASSWORD}
     m2: # 业务库 xiaoqu_franchisee_d（warehouse_agent_auth 等）
       driver-class-name: com.mysql.cj.jdbc.Driver
       jdbc-url: jdbc:mysql://192.168.1.181:3306/xiaoqu_franchisee_d?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
-      username: root
-      password: ${M2_DB_PASSWORD:kaixinjiuhao}
+      username: ${M2_DB_USERNAME}
+      password: ${M2_DB_PASSWORD}
     svc: # 自有库 xiaoqu_agent_svc_d（token/scope/tool/audit，读写）
       driver-class-name: com.mysql.cj.jdbc.Driver
       jdbc-url: jdbc:mysql://192.168.1.181:3306/xiaoqu_agent_svc_d?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
-      username: root
-      password: ${SVC_DB_PASSWORD:kaixinjiuhao}
+      username: ${SVC_DB_USERNAME}
+      password: ${SVC_DB_PASSWORD}
 
 spring:
   data:
     redis:
       host: 192.168.1.181
       port: 6379
-      password: ${REDIS_PASSWORD:kaixinjiuhao}
+      password: ${REDIS_PASSWORD}
       database: 5
       timeout: 5s