Audit fixes: LIVE symbols/fills/expiry/pending, security harden, add 更新说明.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/credentials.py

@@ -38,11 +38,15 @@ def get_credentials() -> tuple[str, str]:
 
 def upsert_env_file(key: str, value: str) -> Path | None:
     """写入第一个已存在的 .env；都不存在则写仓库根 .env。"""
+    if "\n" in value or "\r" in value:
+        raise ValueError(f"{key} 值不能包含换行")
     paths = _env_paths()
     target = next((p for p in paths if p.is_file()), paths[0])
     target.parent.mkdir(parents=True, exist_ok=True)
     text = target.read_text(encoding="utf-8") if target.is_file() else ""
-    line = f"{key}={value}"
+    # 简单引号，避免空格/特殊字符破坏解析
+    safe = value.replace("\\", "\\\\").replace('"', '\\"')
+    line = f'{key}="{safe}"'
     pattern = re.compile(rf"(?m)^{re.escape(key)}=.*$")
     if pattern.search(text):
         text = pattern.sub(line, text)
@@ -51,6 +55,10 @@ def upsert_env_file(key: str, value: str) -> Path | None:
             text += "\n"
         text += line + "\n"
     target.write_text(text, encoding="utf-8")
+    try:
+        target.chmod(0o600)
+    except Exception:
+        pass
     return target