修复认证挑战与可信代理安全边界（07-17-auth-challenge-trusted-proxy-hardening）

deploy/trialrun/.env.example

@@ -23,6 +23,7 @@ APP_ORIGIN=https://oa.example.com
 APP_TIMEZONE=Asia/Shanghai
 HOST=0.0.0.0
 PORT=3000
+TRUST_PROXY_HOPS=1
 COOKIE_SECURE=true
 OPENAPI_DOCS_ENABLED=false
 SERVE_CLIENT_DIST=true
@@ -32,13 +33,22 @@ MAX_UPLOAD_SIZE_BYTES=10485760
 
 # ===== 服务端密钥（必须修改） =====
 JWT_SECRET=<managed-jwt-secret>
+AUTH_CODE_PEPPER=<managed-auth-code-pepper>
 FIELD_ENCRYPTION_KEY=
 
 # ===== 密码 / 登录安全 =====
 PASSWORD_RESET_CODE_TTL_SECONDS=600
+PASSWORD_RESET_FAIL_WINDOW_SECONDS=1800
+PASSWORD_RESET_MAX_ATTEMPTS=5
+PASSWORD_RESET_LOCK_SECONDS=1800
+PASSWORD_RESET_REQUEST_WINDOW_SECONDS=3600
+PASSWORD_RESET_REQUEST_MAX=3
+AUTH_CODE_REQUEST_COOLDOWN_SECONDS=60
 DEV_SHOW_PASSWORD_RESET_CODE=false
 EMAIL_LOGIN_CODE_TTL_SECONDS=600
 EMAIL_LOGIN_CODE_MAX_ATTEMPTS=5
+EMAIL_LOGIN_CODE_FAIL_WINDOW_SECONDS=1800
+EMAIL_LOGIN_CODE_LOCK_SECONDS=1800
 AUTH_LOGIN_FAIL_WINDOW_SECONDS=900
 AUTH_LOGIN_FAIL_MAX_ATTEMPTS=5
 AUTH_LOGIN_LOCK_SECONDS=1800