Audit fixes: LIVE symbols/fills/expiry/pending, security harden, add 更新说明.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/main.py

@@ -39,6 +39,17 @@ async def lifespan(app: FastAPI):
     settings = load_runtime_settings()
     engine = StrategyEngine()
     set_engine(engine)
+    # LIVE：进程启动后不自动真下单，须人工点「启动」
+    if not get_settings().is_sim:
+        try:
+            db._conn.execute(
+                "UPDATE strategy_state SET running=0, phase=? WHERE id=1",
+                ("paused",),
+            )
+            db._conn.commit()
+            logger.info("LIVE startup: forced strategy pause (manual start required)")
+        except Exception:
+            logger.exception("LIVE startup force-pause failed")
     engine.ensure_loop()
 
     session = bootstrap_session(settings)
@@ -74,14 +85,17 @@ async def lifespan(app: FastAPI):
 
 app = FastAPI(
     title="比特骆驼自动化对冲系统",
-    version="0.3.0",
+    version="0.3.1",
     description="比特骆驼自动化对冲系统（eth_hedge_sim）",
     lifespan=lifespan,
+    docs_url=None if get_settings().disable_api_docs else "/docs",
+    redoc_url=None if get_settings().disable_api_docs else "/redoc",
+    openapi_url=None if get_settings().disable_api_docs else "/openapi.json",
 )
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
-    allow_credentials=True,
+    allow_origins=[],
+    allow_credentials=False,
     allow_methods=["*"],
     allow_headers=["*"],
 )