feat: 开源准备与 upgrade URL 构建时配置

- upgrade: SECRETS_UPGRADE_URL 改为构建时优先（option_env!），CI 自动注入
- upgrade: 支持运行时回退（.env/export），添加 dotenvy 加载 .env
- 泛化示例：IP/实例 ID/域名/密钥名改为示例值（10.0.0.1、example.com 等）
- tasks.json: 文件 secret 测试改用 test-fixtures/example-key.pem
- 文档更新：AGENTS.md、README.md

Made-with: Cursor

src/commands/upgrade.rs

@@ -5,10 +5,26 @@ use sha2::{Digest, Sha256};
 use std::io::{Cursor, Read, Write};
 use std::time::Duration;
 
-const GITEA_API: &str = "https://gitea.refining.dev/api/v1/repos/refining/secrets/releases/latest";
-
 const CURRENT_VERSION: &str = env!("CARGO_PKG_VERSION");
 
+/// Build-time config via `option_env!("SECRETS_UPGRADE_URL")`. Set during `cargo build`, e.g.:
+///   SECRETS_UPGRADE_URL=https://... cargo build --release
+const BUILD_UPGRADE_URL: Option<&'static str> = option_env!("SECRETS_UPGRADE_URL");
+
+fn upgrade_api_url() -> Result<String> {
+    if let Some(url) = BUILD_UPGRADE_URL.filter(|s| !s.trim().is_empty()) {
+        return Ok(url.to_string());
+    }
+    let url = std::env::var("SECRETS_UPGRADE_URL").context(
+        "SECRETS_UPGRADE_URL is not set at build or runtime. Set it when building: \
+         SECRETS_UPGRADE_URL=https://... cargo build, or export before running secrets upgrade.",
+    )?;
+    if url.trim().is_empty() {
+        anyhow::bail!("SECRETS_UPGRADE_URL is empty.");
+    }
+    Ok(url)
+}
+
 #[derive(Debug, Deserialize)]
 struct Release {
     tag_name: String,
@@ -186,13 +202,14 @@ pub async fn run(check_only: bool) -> Result<()> {
         .build()
         .context("failed to build HTTP client")?;
 
+    let api_url = upgrade_api_url()?;
     let release: Release = client
-        .get(GITEA_API)
+        .get(&api_url)
         .send()
         .await
-        .context("failed to fetch release info from Gitea")?
+        .context("failed to fetch release info")?
         .error_for_status()
-        .context("Gitea API returned an error")?
+        .context("release API returned an error")?
         .json()
         .await
         .context("failed to parse release JSON")?;