fix: 移除ERP密码和API密钥硬编码，改为环境变量；erp-sync接口加鉴权

backend/app/utils/calc_engine.py

@@ -1,11 +1,11 @@
 """KPI计算引擎 v4 — 基于会计科目余额和销售报表"""
-import httpx, asyncio
+import httpx, asyncio, os
 from datetime import datetime
 from app.database import get_session_local
 from app.models import KPIDefinition, KPIValue
 
 ERP_API = "http://127.0.0.1:8300"
-ERP_KEY = "erp-gateway-key-bhwl-2026"
+ERP_KEY = os.environ.get("ERP_API_KEY", "erp-gateway-key-bhwl-2026")
 
 async def _get(url: str, params: dict = None):
     async with httpx.AsyncClient(timeout=20) as c: