fix: 移除ERP密码和API密钥硬编码，改为环境变量；erp-sync接口加鉴权

backend/app/utils/calc_engine.py

@@ -1,11 +1,11 @@
 """KPI计算引擎 v4 — 基于会计科目余额和销售报表"""
-import httpx, asyncio
+import httpx, asyncio, os
 from datetime import datetime
 from app.database import get_session_local
 from app.models import KPIDefinition, KPIValue
 
 ERP_API = "http://127.0.0.1:8300"
-ERP_KEY = "erp-gateway-key-bhwl-2026"
+ERP_KEY = os.environ.get("ERP_API_KEY", "erp-gateway-key-bhwl-2026")
 
 async def _get(url: str, params: dict = None):
     async with httpx.AsyncClient(timeout=20) as c:

backend/app/utils/cost_engine.py

@@ -2,7 +2,7 @@
 标准成本vs实际成本差异分析（量差/价差/效率差异）
 ABC作业成本法分配
 """
-import logging
+import logging, os
 from datetime import datetime
 from typing import Optional, List, Dict
 from app.database import get_session_local
@@ -11,7 +11,7 @@ from app.models import StandardCost, ActualCost, AbcActivity, AbcAllocation, KPI
 logger = logging.getLogger("cma.cost")
 
 ERP_API = "http://127.0.0.1:8300"
-ERP_KEY = "erp-gateway-key-bhwl-2026"
+ERP_KEY = os.environ.get("ERP_API_KEY", "erp-gateway-key-bhwl-2026")
 
 
 # ============================================================