chore(security): 凭据治理收口 — 清除硬编码DB账号/口令，脚本与API统一从 backend/.env 读取(无明文兜底)；取消跟踪 .pyc 构建产物 (credential-governance-20260912)

backend/scripts/fix_kpi_governance.py

@@ -8,6 +8,17 @@
 import sys
 import pymysql
 
+# 2026-09-12 库访问治理（ops）：口令改从 .env 读取，清除硬编码
+import os as _os_gov
+try:
+    from dotenv import load_dotenv as _ld_gov
+    _ld_gov('/root/cma-management/backend/.env', override=False)
+except Exception:
+    pass
+_CMA_DB_PASS = _os_gov.getenv('CMA_DB_PASS', '')
+_CMA_DB_USER = _os_gov.getenv('CMA_DB_USER', '')
+_CMA_DB_HOST = _os_gov.getenv('CMA_DB_HOST', '127.0.0.1')
+
 PLACEHOLDERS = ("待补充", "待指定", "待完善", "待定", "暂无", "TBD", "tbd", "-", "--", "N/A", "n/a")
 DIM_PREFIX = {"finance": "F", "customer": "C", "process": "P", "learning": "L"}
 DIM_FORMULA = {
@@ -82,8 +93,8 @@ def audit(kpis):
 
 def main():
     apply = "--apply" in sys.argv
-    conn = pymysql.connect(host="127.0.0.1", port=3306, user="cma_user",
-                           password="cma_pass_2026", database="cma", charset="utf8mb4")
+    conn = pymysql.connect(host="127.0.0.1", port=3306, user=_CMA_DB_USER,
+                           password=_CMA_DB_PASS, database="cma", charset="utf8mb4")
     cur = conn.cursor(pymysql.cursors.DictCursor)
     cur.execute("SELECT * FROM kpi_definitions WHERE status='active'")
     kpis = cur.fetchall()