feat(security): privacy hardening + data export (v0.2.1)

- CORS: default localhost-only origins (was *, allowed any webpage
  to read local health data cross-site); env override MI_FITNESS_CORS_ORIGINS
- Host header allowlist middleware on FastAPI and Flask (DNS-rebinding
  protection); auto-configured for non-loopback binds via CLI
- Move API key passTokens from SQLite plaintext to system keyring,
  with automatic migration on startup and cleanup for revoked keys
- Disable uvicorn access log by default (query params out of terminals)
- New GET /api/export: JSON/CSV export of local data (offline, Excel BOM)
- Add docs/PRIVACY.md: full data-flow audit, outbound endpoint inventory,
  threat model, self-verification steps
- 6 new tests (host allowlist, keyring roundtrip, CSV)

.env.example

@@ -1,10 +1,14 @@
 # 运行时环境变量示例（可选；均由服务进程读取，不要把真实值提交进仓库）
 
 # --- REST API (mi-fitness-mcp api) / Web 仪表盘 (mi-fitness-mcp web) ---
-# 设置后所有数据端点要求 X-API-Key 头
+# 设置后所有数据端点要求 X-API-Key 头（防止本机其他进程/局域网读取健康数据）
 # MI_FITNESS_API_KEY=change-me
 # 管理端点（Key 发放/列表/吊销、扫码登录）要求 X-Admin-Key；未设置时仅限 127.0.0.1 调用
 # MI_FITNESS_ADMIN_KEY=change-me
+# Host 头白名单（防 DNS 重绑定），逗号分隔；非回环绑定时 CLI 会自动设置，一般无需手动配置
+# MI_FITNESS_ALLOWED_HOSTS=127.0.0.1,localhost
+# CORS 来源白名单（默认仅本机来源）；如需放开给指定前端才配置，慎用 *
+# MI_FITNESS_CORS_ORIGINS=http://localhost:3000
 
 # --- Web 仪表盘 (mi-fitness-mcp web) ---
 # MI_FITNESS_API_URL=http://127.0.0.1:8321   # 反向代理的后端 FastAPI 地址