让七月迭代具备可直接部署的配置基线

补齐三套环境配置、测试环境部署门禁与 system_config 初始化，并按当前无企微应用的约束将企微凭据改为明文存储。

Constraint: 当前测试环境尚无企微应用及历史企微密文数据

Rejected: 使用启动环境变量加密企微凭据 | 用户明确要求直接明文保存并移除加密密钥

Confidence: high

Scope-risk: moderate

Directive: 企微真实闭环完成前保持两个旧审批入口开关为 true

Tested: gofmt；git diff --check；bash -n；docker compose config；Gitea workflow YAML 解析；OpenAPI 重新生成

Not-tested: go test；常规 go build；LSP；实际数据库迁移；真实测试环境部署；企微真实联调

internal/bootstrap/handlers.go

@@ -31,7 +31,6 @@ import (
 	"github.com/break/junhong_cmp_fiber/pkg/config"
 	"github.com/break/junhong_cmp_fiber/pkg/constants"
 	"github.com/go-playground/validator/v10"
-	"go.uber.org/zap"
 )
 
 func initHandlers(svc *services, deps *Dependencies) *Handlers {
@@ -111,27 +110,18 @@ func initHandlers(svc *services, deps *Dependencies) *Handlers {
 		deps.DB, systemConfigRegistry, systemConfigCache, deps.SystemConfigAudit, systemConfigAlerts, nil,
 	)
 	wecomRepository := wecomInfra.NewApplicationRepository(deps.DB)
-	var credentialCipher *wecomInfra.CredentialCipher
 	wecomBaseURL := ""
 	wecomTimeout := constants.WeComDefaultHTTPTimeout
 	if cfg := config.Get(); cfg != nil {
 		wecomBaseURL = cfg.WeCom.BaseURL
 		wecomTimeout = cfg.WeCom.Timeout
-		cipher, err := wecomInfra.NewCredentialCipher(cfg.WeCom.CredentialEncryptionKey)
-		if err != nil {
-			if deps.Logger != nil {
-				deps.Logger.Warn("企业微信凭据加密密钥未配置或无效，相关接口将拒绝业务调用", zap.Error(err))
-			}
-		} else {
-			credentialCipher = cipher
-		}
 	}
 	wecomTokens := wecomInfra.NewTokenProvider(
-		wecomRepository, credentialCipher, deps.Redis, integrationlog.NewRepository(deps.DB),
+		wecomRepository, deps.Redis, integrationlog.NewRepository(deps.DB),
 		wecomBaseURL, wecomTimeout, deps.Logger,
 	)
 	wecomConnections := wecomApp.NewConnectionService(
-		deps.DB, wecomRepository, credentialCipher, wecomTokens, deps.SystemConfigAudit,
+		deps.DB, wecomRepository, wecomTokens, deps.SystemConfigAudit,
 	)
 	wecomMembers := wecomInfra.NewMemberRepository(deps.DB)
 	wecomConnections.SetDefaultCreatorMemberFinder(wecomMembers)
@@ -146,7 +136,7 @@ func initHandlers(svc *services, deps *Dependencies) *Handlers {
 		wecomInfra.NewSceneRepository(deps.DB), deps.SystemConfigAudit,
 	)
 	wecomApprovalCallback := callback.NewWeComApprovalHandler(wecomInfra.NewCallbackService(
-		wecomRepository, credentialCipher, integrationlog.NewRepository(deps.DB), deps.QueueClient,
+		wecomRepository, integrationlog.NewRepository(deps.DB), deps.QueueClient,
 	))
 	svc.Account.SetWeComMemberFinder(wecomMembers)
 

internal/bootstrap/services.go

@@ -291,15 +291,13 @@ func initServices(s *stores, deps *Dependencies) *services {
 	wecomMemberRepository := wecomInfra.NewMemberRepository(deps.DB)
 	wecomBaseURL := ""
 	wecomTimeout := constants.WeComDefaultHTTPTimeout
-	var wecomCredentialCipher *wecomInfra.CredentialCipher
 	if cfg := config.Get(); cfg != nil {
 		wecomBaseURL = cfg.WeCom.BaseURL
 		wecomTimeout = cfg.WeCom.Timeout
-		wecomCredentialCipher, _ = wecomInfra.NewCredentialCipher(cfg.WeCom.CredentialEncryptionKey)
 	}
 	wecomIntegrationRepository := integrationlog.NewRepository(deps.DB)
 	wecomTokenProvider := wecomInfra.NewTokenProvider(
-		wecomApplicationRepository, wecomCredentialCipher, deps.Redis, wecomIntegrationRepository,
+		wecomApplicationRepository, deps.Redis, wecomIntegrationRepository,
 		wecomBaseURL, wecomTimeout, deps.Logger,
 	)
 	approvalCreationService := approvalApp.NewCreationService(