fix: 移除ERP密码和API密钥硬编码，改为环境变量；erp-sync接口加鉴权

backend/app/utils/cost_engine.py

@@ -2,7 +2,7 @@
 标准成本vs实际成本差异分析（量差/价差/效率差异）
 ABC作业成本法分配
 """
-import logging
+import logging, os
 from datetime import datetime
 from typing import Optional, List, Dict
 from app.database import get_session_local
@@ -11,7 +11,7 @@ from app.models import StandardCost, ActualCost, AbcActivity, AbcAllocation, KPI
 logger = logging.getLogger("cma.cost")
 
 ERP_API = "http://127.0.0.1:8300"
-ERP_KEY = "erp-gateway-key-bhwl-2026"
+ERP_KEY = os.environ.get("ERP_API_KEY", "erp-gateway-key-bhwl-2026")
 
 
 # ============================================================