fix: 移除ERP密码和API密钥硬编码，改为环境变量；erp-sync接口加鉴权

backend/app/main.py

@@ -1,13 +1,14 @@
 """管理会计OS — 主入口"""
 import logging
-from fastapi import FastAPI, Request
+from fastapi import FastAPI, Request, Depends
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
 from dotenv import load_dotenv
 from app.database import init_db
-from app.api import auth, kpis, maps, dashboard, data, alerts, ai_analysis, alert_rules, users, thresholds, notifications, permissions, action_plans, alignment, org, objectives, versions, budget, cost, predict
+from app.api import auth, kpis, templates, maps, dashboard, data, alerts, ai_analysis, alert_rules, users, thresholds, notifications, permissions, action_plans, alignment, org, objectives, versions, budget, cost, predict, reports, security
 from app.utils.cache import clear_all as clear_cache, delete as delete_cache
 from scripts.erp_sync import run_sync as run_erp_sync
+from app.auth_middleware import require_auth
 
 load_dotenv()
 
@@ -31,6 +32,7 @@ app.add_middleware(
 
 app.include_router(auth.router)
 app.include_router(kpis.router)
+app.include_router(templates.router)
 app.include_router(maps.router)
 app.include_router(dashboard.router)
 app.include_router(data.router)
@@ -49,6 +51,8 @@ app.include_router(versions.router)
 app.include_router(budget.router)
 app.include_router(cost.router)
 app.include_router(predict.router)
+app.include_router(reports.router)
+app.include_router(security.router)
 
 @app.exception_handler(Exception)
 async def global_exception_handler(request: Request, exc: Exception):
@@ -63,7 +67,7 @@ def startup():
 
 
 @app.post("/api/cma/admin/erp-sync")
-def admin_erp_sync(kpi_codes: str = None):
+def admin_erp_sync(user=Depends(require_auth), kpi_codes: str = None):
     """手动触发ERP数据同步"""
     kpi_list = kpi_codes.split(",") if kpi_codes else None
     try:
@@ -74,7 +78,7 @@ def admin_erp_sync(kpi_codes: str = None):
 
 
 @app.get("/api/cma/admin/erp-sync/dry-run")
-def admin_erp_sync_dry_run(kpi_codes: str = None):
+def admin_erp_sync_dry_run(user=Depends(require_auth), kpi_codes: str = None):
     "试运行，不写入数据库"""
     kpi_list = kpi_codes.split(",") if kpi_codes else None
     try: