feat: support Baota manual deployment and managed updates

deploy/baota.env.example

@@ -1,14 +1,11 @@
-SPRING_PROFILES_ACTIVE=production
-SERVER_ADDRESS=127.0.0.1
-SERVER_PORT=18080
-SESSION_COOKIE_SECURE=false
-DB_URL=jdbc:mysql://MYSQL_HOST:3306/kaidi_finance?useUnicode=true&characterEncoding=utf8&connectionTimeZone=UTC&serverTimezone=UTC
-DB_USERNAME=MYSQL_USERNAME
-DB_PASSWORD=MYSQL_PASSWORD
-FIELD_ENCRYPTION_KEY=EXISTING_FIELD_ENCRYPTION_KEY
-FILE_STORAGE_ROOT=/var/lib/kaidi/files
-FILE_STORAGE_TEMP=/var/lib/kaidi/tmp
-FILE_SCANNER_ENABLED=false
-FINANCE_BOOTSTRAP_ENABLED=false
-FINANCE_SETUP_ENABLED=false
-FINANCE_UPDATE_ENABLED=false
+# Baota project environment variables are intentionally empty.
+# Do not paste database passwords or placeholder values into the panel.
+# ops/baota-start.sh loads the protected files created by ops/baota-init.sh:
+#   /etc/kaidi/kaidi.env
+#   /var/lib/kaidi/setup/application.env (after the setup wizard completes)
+#
+# Optional non-secret overrides may be added deliberately, for example:
+# SERVER_PORT=18080
+# SESSION_COOKIE_SECURE=true
+# Never override DB_URL, DB_USERNAME, DB_PASSWORD, FIELD_ENCRYPTION_KEY,
+# FINANCE_SETUP_TOKEN_SHA256, or the update paths from the panel.