chore(security): 摘除 knowledge_service 硬编码默认 DeepSeek Key（缺 env 抛明确错误/503）

- knowledge_service: 移除 os.getenv 默认值占位，改 _require_deepseek_key() 必填，缺 env 抛 DeepSeekKeyMissing
- knowledge API: generate/{daily,weekly,monthly} 缺 Key 返回 503（可观测，不再静默走模板兜底）
- finance_bot / verify_zxt_vouchers_json / bot_bridge_push: 凭据改 env 优先（CMA_BOT_KEY_* / CMA_BOT_API_KEYS / CMA_BRIDGE_TOKEN），历史共享键仅作兼容期兜底并告警
- tests: 新增 5 例回归（缺 Key 服务层抛错、API 503；有 Key 正常 200）

(cherry picked from commit 859bd8276d7c5aad4bf10ee3399b6cccc188f064)

backend/scripts/bot_bridge_push.py

@@ -33,7 +33,14 @@ from typing import Optional
 import httpx
 
 CMA_API = os.getenv("CMA_API", "http://127.0.0.1:8010/api/cma/bot-bridge")
-BRIDGE_TOKEN = os.getenv("CMA_BRIDGE_TOKEN", "cma-bot-bridge-2026")
+
+# 凭据只应从环境变量取；兼容期兜底历史共享 Token（P3 待轮换，轮换后删除兜底）
+_LEGACY_BRIDGE_TOKEN = "cma-bot-bridge-2026"
+BRIDGE_TOKEN = (os.getenv("CMA_BRIDGE_TOKEN") or "").strip()
+if not BRIDGE_TOKEN:
+    print("[WARN] CMA_BRIDGE_TOKEN 未配置，回退历史共享 Token（待轮换）", file=sys.stderr)
+    BRIDGE_TOKEN = _LEGACY_BRIDGE_TOKEN
+
 
 # MPM字段 → KPI编码映射（与 bot_bridge_v2.MPM_TO_KPI_MAP 保持一致）
 MPM_TO_KPI_MAP = {

backend/scripts/finance_bot.py

@@ -7,7 +7,29 @@ sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 
 # 直接调用BOT API
 CMA_BOT_API = "http://127.0.0.1:8010/api/cma/bot"
-API_KEY = "cma-bot-finance-2026"
+
+# 凭据来源优先级：CMA_BOT_KEY_FINANCE（单键）→ CMA_BOT_API_KEYS（JSON 注册表，取 role=finance）
+# 兼容期兜底：历史共享键（P3 待轮换，轮换后删除本兜底）
+_LEGACY_SHARED_KEY = "cma-bot-finance-2026"
+
+
+def _resolve_api_key() -> str:
+    key = (os.getenv("CMA_BOT_KEY_FINANCE") or "").strip()
+    if key:
+        return key
+    raw = (os.getenv("CMA_BOT_API_KEYS") or "").strip()
+    if raw:
+        try:
+            for k, v in json.loads(raw).items():
+                if isinstance(v, dict) and v.get("role") == "finance":
+                    return k
+        except Exception:
+            pass
+    print("[WARN] 未配置 CMA_BOT_KEY_FINANCE / CMA_BOT_API_KEYS，回退历史共享键（待轮换）", file=sys.stderr)
+    return _LEGACY_SHARED_KEY
+
+
+API_KEY = _resolve_api_key()
 
 import httpx
 from datetime import datetime

backend/scripts/verify_zxt_vouchers_json.py

@@ -47,7 +47,28 @@ def override_get_db():
 app.dependency_overrides[get_db] = override_get_db
 client = TestClient(app)
 
-HDR = {"X-BOT-KEY": "cma-bot-admin-2026"}
+# 凭据来源：CMA_BOT_KEY_ADMIN → CMA_BOT_API_KEYS(role=ceo/admin) → 兼容期历史共享键（P3 待轮换）
+_LEGACY_ADMIN_KEY = "cma-bot-admin-2026"
+
+
+def _resolve_admin_key() -> str:
+    key = (os.getenv("CMA_BOT_KEY_ADMIN") or "").strip()
+    if key:
+        return key
+    raw = (os.getenv("CMA_BOT_API_KEYS") or "").strip()
+    if raw:
+        try:
+            import json as _json
+            for k, v in _json.loads(raw).items():
+                if isinstance(v, dict) and v.get("role") in ("ceo", "admin"):
+                    return k
+        except Exception:
+            pass
+    return _LEGACY_ADMIN_KEY
+
+
+HDR = {"X-BOT-KEY": _resolve_admin_key()}
+
 
 def check(name, cond, detail=""):
     print(("PASS " if cond else "FAIL ") + name + (" | " + detail if detail else ""))