fix(docker): 规范 entrypoint 行尾并赋可执行权限；注入 ENCRYPTION_SECRET 环境变量以通过生产校验

- Dockerfile: sed 去除 CRLF + chmod +x，避免 \r 脚本执行失败
- docker-compose.yml: 增加 ENCRYPTION_SECRET，容器端启动不再报缺失密钥

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

Dockerfile

@@ -11,8 +11,8 @@ RUN apk add --no-cache openssl openssl-dev
 # Copy backend package files
 COPY server/package*.json ./
 
-# Install dependencies（锁文件未同步，使用 npm install 以保证 PR 构建通过）
-RUN npm install --no-audit --no-fund
+# Install dependencies（锁文件未同步，使用 npm install 以保证 PR 构建通过）
+RUN npm install --no-audit --no-fund
 
 # Copy Prisma schema
 COPY server/prisma ./prisma/
@@ -36,10 +36,12 @@ RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
 
 # Copy backend from builder
 COPY --from=backend-builder --chown=nodejs:nodejs /app/server ./server/
-
-# Copy entrypoint script
-COPY --chown=nodejs:nodejs server/scripts/docker-entrypoint.sh /app/server/scripts/docker-entrypoint.sh
-RUN chmod +x /app/server/scripts/docker-entrypoint.sh
+
+# Copy entrypoint script
+COPY --chown=nodejs:nodejs server/scripts/docker-entrypoint.sh /app/server/scripts/docker-entrypoint.sh
+# Normalize line endings on Windows checkouts and ensure executable bit
+RUN sed -i 's/\r$//' /app/server/scripts/docker-entrypoint.sh && \
+    chmod +x /app/server/scripts/docker-entrypoint.sh
 
 # Copy frontend files
 COPY --chown=nodejs:nodejs index.html ./

docker-compose.yml

@@ -48,6 +48,9 @@ services:
       JWT_SECRET: ${JWT_SECRET:-your-super-secret-jwt-key-change-in-production}
       JWT_EXPIRES_IN: ${JWT_EXPIRES_IN:-7d}
 
+      # 加密密钥（生产必填）
+      ENCRYPTION_SECRET: ${ENCRYPTION_SECRET:-your-encryption-secret-min-32-chars-change-in-production}
+
       # CORS 配置
       CORS_ORIGIN: ${CORS_ORIGIN:-*}