fix(backend): secure production startup and migrations

backend/etc/agent.prod.example.yaml

@@ -0,0 +1,11 @@
+# 复制为 agent.prod.yaml 后使用；change-me 值会被生产校验拒绝。
+env: production
+port: "9150"
+dsn: "postgres://change-me"
+storage_dir: "/var/lib/senlinai/files"
+max_upload_bytes: 33554432
+auth_secret: "change-me-with-an-independent-random-secret"
+system_ai_key: ""
+ai_key_encryption_secret: "change-me-with-a-different-random-secret"
+allowed_origins:
+  - "https://workbench.example.com"