feat: REST API with API keys, QR login, and web dashboard (v0.2.0)

- REST API (FastAPI): all data endpoints, sync (foreground/background),
  coverage stats, interactive docs at /docs
- API key system: exchange Xiaomi credentials for mif_sk_* keys
  (multi-account contexts, last-used tracking, prefix revocation);
  static key via MI_FITNESS_API_KEY, admin endpoints via MI_FITNESS_ADMIN_KEY
- QR code login: reverse-engineered Xiaomi universal QR flow
  (sid=xiaomiio), auto-issues API key after scan confirmation
- Built-in web dashboard (Flask): visual console for all endpoints,
  key management, QR login; reverse proxy with server-side key relay
- Standalone testpage/ console (python app.py, no install needed)
- Fix: pin mcp<2 (SDK 2.x removed Server.list_tools, broke startup)
- CI: install [all,dev] extras; docs: full technical documentation
  and QR login implementation guide

.env.example

@@ -1,3 +1,16 @@
-MI_FITNESS_USER_ID=replace_me
-MI_FITNESS_PASS_TOKEN=replace_me
-MI_FITNESS_REGION=ru
+# 运行时环境变量示例（可选；均由服务进程读取，不要把真实值提交进仓库）
+
+# --- REST API (mi-fitness-mcp api) / Web 仪表盘 (mi-fitness-mcp web) ---
+# 设置后所有数据端点要求 X-API-Key 头
+# MI_FITNESS_API_KEY=change-me
+# 管理端点（Key 发放/列表/吊销、扫码登录）要求 X-Admin-Key；未设置时仅限 127.0.0.1 调用
+# MI_FITNESS_ADMIN_KEY=change-me
+
+# --- Web 仪表盘 (mi-fitness-mcp web) ---
+# MI_FITNESS_API_URL=http://127.0.0.1:8321   # 反向代理的后端 FastAPI 地址
+
+# --- Rust 测试页 (testpage/) ---
+# BIND=127.0.0.1:8322                         # 监听地址
+# MI_FITNESS_API_URL=http://127.0.0.1:8321
+
+# 小米凭据不走环境变量：用 mi-fitness-mcp setup（keyring 存储）或扫码登录发放 Key。