chore: 移除 config.py 硬编码凭据，.env 纳入忽略

- config.py 中的 tencent/wx_mini 密钥默认值改回空串，改由 .env 提供
- .gitignore 打开 .env 与 **/.env 规则，避免再次误提交

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitignore

@@ -16,7 +16,8 @@ Thumbs.db
 *.sublime-*
 
 # 环境变量 / 密钥
-# .env
+.env
+**/.env
 .env.*
 !.env.example
 *.pem

backend/app/config.py

@@ -28,6 +28,10 @@ class Settings(BaseSettings):
     tencent_secret_key: str = ""
     tencent_region: str = "ap-guangzhou"
 
+    wx_mini_appid: str = ""
+    wx_mini_secret: str = ""
+    wx_mini_mock_phone: str = "13800000000"
+
     @property
     def cors_origins(self) -> list[str]:
         return [origin.strip() for origin in self.allowed_origins.split(",") if origin.strip()]