fix(fix3): runtime env hardening and public endpoint source-of-truth

orchestrator/src/config/env.ts

@@ -7,6 +7,13 @@ function randomSecret(): string {
   return randomBytes(24).toString("base64url");
 }
 
+function valueOrGenerate(value: string | undefined): string {
+  if (!value || value === "__GENERATE__") {
+    return randomSecret();
+  }
+  return value;
+}
+
 function parseEnv(content: string): EnvMap {
   const result: EnvMap = {};
   for (const rawLine of content.split(/\r?\n/)) {
@@ -111,7 +118,7 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
     uiBindHost,
     uiPort,
     adminUser: requireValue("HY2XS_ADMIN_USER", env.HY2XS_ADMIN_USER || "admin"),
-    adminInitialPassword: env.HY2XS_ADMIN_INITIAL_PASSWORD || randomSecret(),
+    adminInitialPassword: valueOrGenerate(env.HY2XS_ADMIN_INITIAL_PASSWORD),
     forcePasswordChange: parseBool("HY2XS_FORCE_PASSWORD_CHANGE", env.HY2XS_FORCE_PASSWORD_CHANGE, true),
     tlsMode,
     acmeType,
@@ -127,9 +134,9 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
       env.HY2XS_HYSTERIA_TRAFFIC_STATS_HOST || "127.0.0.1"
     ),
     hysteriaTrafficStatsPort: trafficStatsPort,
-    hysteriaTrafficStatsSecret: env.HY2XS_HYSTERIA_TRAFFIC_STATS_SECRET || randomSecret(),
+    hysteriaTrafficStatsSecret: valueOrGenerate(env.HY2XS_HYSTERIA_TRAFFIC_STATS_SECRET),
     hysteriaObfsType: "salamander",
-    hysteriaObfsPassword: requireValue("HY2XS_HYSTERIA_OBFS_PASSWORD", env.HY2XS_HYSTERIA_OBFS_PASSWORD || randomSecret()),
+    hysteriaObfsPassword: requireValue("HY2XS_HYSTERIA_OBFS_PASSWORD", valueOrGenerate(env.HY2XS_HYSTERIA_OBFS_PASSWORD)),
     hysteriaBandwidthUp: env.HY2XS_HYSTERIA_BANDWIDTH_UP || "50 mbps",
     hysteriaBandwidthDown: env.HY2XS_HYSTERIA_BANDWIDTH_DOWN || "50 mbps",
     hysteriaIgnoreClientBandwidth: parseBool(