chore(security): 凭据治理收口 — 清除硬编码DB账号/口令，脚本与API统一从 backend/.env 读取(无明文兜底)；取消跟踪 .pyc 构建产物 (credential-governance-20260912)

scripts/sync_wecom_users.py

@@ -12,12 +12,23 @@ import urllib.request
 import pymysql
 import hashlib
 
+# 2026-09-12 库访问治理（ops）：口令改从 .env 读取，清除硬编码
+import os as _os_gov
+try:
+    from dotenv import load_dotenv as _ld_gov
+    _ld_gov('/root/cma-management/backend/.env', override=False)
+except Exception:
+    pass
+_CMA_DB_PASS = _os_gov.getenv('CMA_DB_PASS', '')
+_CMA_DB_USER = _os_gov.getenv('CMA_DB_USER', '')
+_CMA_DB_HOST = _os_gov.getenv('CMA_DB_HOST', '127.0.0.1')
+
 # ==== 配置 ====
 MCP_URL = "http://127.0.0.1:18900/call"
 DB_HOST = "127.0.0.1"
 DB_PORT = 3306
-DB_USER = "cma_user"
-DB_PASS = "cma_pass_2026"
+DB_USER = _CMA_DB_USER
+DB_PASS = _CMA_DB_PASS
 DB_NAME = "cma"
 DEFAULT_PASSWORD = "admin123"