feat(api): 开发平台、门店相关代码

.env.example

@@ -25,6 +25,12 @@ API_PORT=8200
 AUTH_JWT_SECRET=replace-with-a-random-secret-of-at-least-32-characters
 # Separate HMAC secret used to pseudonymize IP/email values in Redis rate-limit keys.
 AUTH_RATE_LIMIT_KEY_SECRET=replace-with-a-different-random-secret-of-at-least-32-characters
+# AES-GCM 密钥材料，用来加密门店 API Key；只保存在服务端，轮换时变更版本号但保留旧密钥解密能力。
+STORE_SECRET_ENCRYPTION_KEY=replace-with-a-random-secret-of-at-least-32-characters
+# 当前门店密钥使用的加密密钥版本，会随密钥轮换递增。
+STORE_SECRET_ENCRYPTION_KEY_VERSION=v1
+# 对幂等请求内容生成 HMAC 摘要的独立密钥，避免数据库保存原始请求体或 API Key。
+IDEMPOTENCY_KEY_SECRET=replace-with-a-different-random-secret-of-at-least-32-characters
 # Server-side minimum password length. The browser must not weaken this rule.
 AUTH_PASSWORD_MIN_LENGTH=12
 # Maximum JSON or URL-encoded request size in bytes. Media files must use object-storage direct upload.