security: replace hardcoded production credentials with Gitea Secrets

- DATABASE_URL, DB_USER, DB_PASSWORD, DB_NAME
- REDIS_PASSWORD, MYSQL_ROOT_PASSWORD, CREDENTIAL_ENCRYPTION_KEY
- All 7 secrets created in Gitea repo settings

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -5,7 +5,7 @@ on:
     branches: [main]
 
 env:
-  DATABASE_URL: mysql://zhixi_user:hKHQ+N0wBjJAiLukFu5OMEI8@127.0.0.1:3306/zhixi_prod
+  DATABASE_URL: ${{ secrets.DATABASE_URL }}
 
 jobs:
   build-and-deploy:
@@ -37,7 +37,7 @@ jobs:
 
       - name: Resolve failed migrations
         run: |
-          MYSQL_CMD="docker exec mysql mysql -u zhixi_user -phKHQ+N0wBjJAiLukFu5OMEI8 zhixi_prod"
+          MYSQL_CMD="docker exec mysql mysql -u ${{ secrets.DB_USER }} -p${{ secrets.DB_PASSWORD }} ${{ secrets.DB_NAME }}"
           FAILED=$($MYSQL_CMD -N -e \
             "SELECT migration_name FROM _prisma_migrations WHERE logs LIKE '%failed%' LIMIT 1;" 2>/dev/null || true)
           if [ -n "$FAILED" ]; then
@@ -109,15 +109,15 @@ jobs:
           cd /tmp/api-server
           bash test/run-integration-tests.sh
         env:
-          DATABASE_URL: mysql://zhixi_user:hKHQ+N0wBjJAiLukFu5OMEI8@127.0.0.1:3306/zhixi_prod
+          DATABASE_URL: ${{ secrets.DATABASE_URL }}
           REDIS_HOST: 127.0.0.1
           REDIS_PORT: '6379'
-          REDIS_PASSWORD: THTC2B5wXvhlMw/ZB6TYwB6MI9r1tO0F
+          REDIS_PASSWORD: ${{ secrets.REDIS_PASSWORD }}
           JWT_SECRET: test-integration-secret
           INTERNAL_API_KEY: test-key
-          CREDENTIAL_ENCRYPTION_KEY: '0123456789abcdef0123456789abcdef'
+          CREDENTIAL_ENCRYPTION_KEY: ${{ secrets.CREDENTIAL_ENCRYPTION_KEY }}
           STORAGE_DRIVER: local
-          MYSQL_ROOT_PASSWORD: Zhixi@2026!Root_8C
+          MYSQL_ROOT_PASSWORD: ${{ secrets.MYSQL_ROOT_PASSWORD }}
         timeout-minutes: 10
 
       - name: Deploy RAG Worker