feat(server): 安全基线（Helmet+限流+脱敏）（E10）

- 注册 @fastify/helmet（CSP 关闭）
- 引入 @fastify/rate-limit，并对 login/forgot/reset 按开关启用
- Fastify logger 增加敏感字段 redaction（authorization/cookie/password 等）

server/package.json

@@ -24,19 +24,21 @@
   "dependencies": {
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",
+    "@fastify/helmet": "^13.0.2",
     "@fastify/jwt": "^10.0.0",
     "@fastify/multipart": "^9.3.0",
+    "@fastify/rate-limit": "^10.3.0",
     "@fastify/static": "^9.0.0",
     "@prisma/adapter-pg": "^7.3.0",
     "@prisma/client": "^7.3.0",
     "bcryptjs": "^3.0.3",
     "fastify": "^5.7.4",
     "fastify-plugin": "^5.1.0",
+    "node-cron": "^4.2.1",
     "pg": "^8.18.0",
     "prisma": "^7.3.0",
-    "zod": "^4.3.6",
-    "node-cron": "^4.2.1",
-    "tencentcloud-sdk-nodejs": "^4.1.14"
+    "tencentcloud-sdk-nodejs": "^4.1.14",
+    "zod": "^4.3.6"
   },
   "devDependencies": {
     "dotenv": "^16.4.5"