开源前加固认证与部署契约：加密随机 JWT、改密事务吊销、登录 CSRF，并禁止生产回落 localhost。

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/Dockerfile.web

@@ -15,6 +15,7 @@ ARG VERSION=dev
 ARG BACKEND_URL=http://api:3001
 ENV NEXT_TELEMETRY_DISABLED=1 \
     NODE_ENV=production \
+    DEV_MODE=false \
     NEXT_PUBLIC_APP_VERSION=${VERSION} \
     BACKEND_URL=${BACKEND_URL}
 RUN npm run build
@@ -22,6 +23,7 @@ RUN npm run build
 FROM node:22-bookworm-slim AS runner
 WORKDIR /app
 ENV NODE_ENV=production \
+    DEV_MODE=false \
     PORT=3000 \
     HOSTNAME=0.0.0.0 \
     NEXT_TELEMETRY_DISABLED=1 \