fix(ops): stop hardcoding DB passwords and URL-embed git tokens

Load backup credentials from env/secrets files and push via a temporary credential helper so tokens never appear in process listings.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/git-push-dev.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# 使用 ~/.secrets/gitea 推送 dev 分支（不写入 git config）
-set -eo pipefail
+# 使用 ~/.secrets/gitea 推送分支（不写入 git config；token 不出现在 URL/`ps`）
+set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 SECRETS="${HOME}/.secrets/gitea"
@@ -20,4 +20,23 @@ if [[ -z "${TOKEN}" || -z "${PREFIX}" ]]; then
 fi
 
 cd "${ROOT_DIR}"
-git push "https://oauth2:${TOKEN}@${PREFIX}/weichen/Agent-System.git" "${BRANCH}"
+
+# 通过临时 credential helper 注入，避免 oauth2:token@host 出现在进程列表。
+HELPER_SCRIPT="$(mktemp)"
+cleanup() {
+  rm -f "${HELPER_SCRIPT}"
+}
+trap cleanup EXIT
+
+cat > "${HELPER_SCRIPT}" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+if [[ "\${1:-}" == "get" ]]; then
+  echo "username=oauth2"
+  echo "password=${TOKEN}"
+fi
+EOF
+chmod 700 "${HELPER_SCRIPT}"
+
+git -c "credential.helper=${HELPER_SCRIPT}" \
+  push "https://${PREFIX}/weichen/Agent-System.git" "${BRANCH}"