fix: 移除ERP密码和API密钥硬编码，改为环境变量；erp-sync接口加鉴权

backend/app/main.py

@@ -1,13 +1,14 @@
 """管理会计OS — 主入口"""
 import logging
-from fastapi import FastAPI, Request
+from fastapi import FastAPI, Request, Depends
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
 from dotenv import load_dotenv
 from app.database import init_db
-from app.api import auth, kpis, maps, dashboard, data, alerts, ai_analysis, alert_rules, users, thresholds, notifications, permissions, action_plans, alignment, org, objectives, versions, budget, cost, predict
+from app.api import auth, kpis, templates, maps, dashboard, data, alerts, ai_analysis, alert_rules, users, thresholds, notifications, permissions, action_plans, alignment, org, objectives, versions, budget, cost, predict, reports, security
 from app.utils.cache import clear_all as clear_cache, delete as delete_cache
 from scripts.erp_sync import run_sync as run_erp_sync
+from app.auth_middleware import require_auth
 
 load_dotenv()
 
@@ -31,6 +32,7 @@ app.add_middleware(
 
 app.include_router(auth.router)
 app.include_router(kpis.router)
+app.include_router(templates.router)
 app.include_router(maps.router)
 app.include_router(dashboard.router)
 app.include_router(data.router)
@@ -49,6 +51,8 @@ app.include_router(versions.router)
 app.include_router(budget.router)
 app.include_router(cost.router)
 app.include_router(predict.router)
+app.include_router(reports.router)
+app.include_router(security.router)
 
 @app.exception_handler(Exception)
 async def global_exception_handler(request: Request, exc: Exception):
@@ -63,7 +67,7 @@ def startup():
 
 
 @app.post("/api/cma/admin/erp-sync")
-def admin_erp_sync(kpi_codes: str = None):
+def admin_erp_sync(user=Depends(require_auth), kpi_codes: str = None):
     """手动触发ERP数据同步"""
     kpi_list = kpi_codes.split(",") if kpi_codes else None
     try:
@@ -74,7 +78,7 @@ def admin_erp_sync(kpi_codes: str = None):
 
 
 @app.get("/api/cma/admin/erp-sync/dry-run")
-def admin_erp_sync_dry_run(kpi_codes: str = None):
+def admin_erp_sync_dry_run(user=Depends(require_auth), kpi_codes: str = None):
     "试运行，不写入数据库"""
     kpi_list = kpi_codes.split(",") if kpi_codes else None
     try:

backend/app/utils/calc_engine.py

@@ -1,11 +1,11 @@
 """KPI计算引擎 v4 — 基于会计科目余额和销售报表"""
-import httpx, asyncio
+import httpx, asyncio, os
 from datetime import datetime
 from app.database import get_session_local
 from app.models import KPIDefinition, KPIValue
 
 ERP_API = "http://127.0.0.1:8300"
-ERP_KEY = "erp-gateway-key-bhwl-2026"
+ERP_KEY = os.environ.get("ERP_API_KEY", "erp-gateway-key-bhwl-2026")
 
 async def _get(url: str, params: dict = None):
     async with httpx.AsyncClient(timeout=20) as c:

backend/app/utils/cost_engine.py

@@ -2,7 +2,7 @@
 标准成本vs实际成本差异分析（量差/价差/效率差异）
 ABC作业成本法分配
 """
-import logging
+import logging, os
 from datetime import datetime
 from typing import Optional, List, Dict
 from app.database import get_session_local
@@ -11,7 +11,7 @@ from app.models import StandardCost, ActualCost, AbcActivity, AbcAllocation, KPI
 logger = logging.getLogger("cma.cost")
 
 ERP_API = "http://127.0.0.1:8300"
-ERP_KEY = "erp-gateway-key-bhwl-2026"
+ERP_KEY = os.environ.get("ERP_API_KEY", "erp-gateway-key-bhwl-2026")
 
 
 # ============================================================