fix: Dashboard统计数据修复 + 生产环境SECRET_KEY强制校验

1. Dashboard统计Bug修复
   - Task统计改用TASK_STATUS_PENDING/WIP/COMPLETED大写常量
   - 旧代码使用小写"pending"/"in_progress"永远匹配不到数据
   - 修复后tasks_pending/tasks_in_progress/tasks_completed返回真实值

2. 生产环境SECRET_KEY强制校验
   - 新增model_validator：DEBUG=False且SECRET_KEY为默认值时抛出ValueError
   - 阻止使用默认密钥部署到生产环境

backend/app/core/config.py

@@ -1,5 +1,6 @@
 """核心配置 — Pydantic Settings 自动从 .env 读取"""
 import json
+from pydantic import model_validator
 from pydantic_settings import BaseSettings
 
 
@@ -26,6 +27,17 @@ class Settings(BaseSettings):
         except (json.JSONDecodeError, TypeError):
             return ["http://localhost:1420", "tauri://localhost"]
 
+    @model_validator(mode="after")
+    def _validate_production_secret(self):
+        """生产环境强制校验：SECRET_KEY 禁止使用默认值"""
+        if not self.DEBUG and self.SECRET_KEY == "change-me-in-production":
+            raise ValueError(
+                "生产环境 (DEBUG=False) 禁止使用默认 SECRET_KEY。"
+                "请在 .env 中设置 SECRET_KEY 为至少 32 字符的随机值。"
+                "示例: python -c \"import secrets; print(secrets.token_urlsafe(32))\""
+            )
+        return self
+
     class Config:
         env_file = ".env"
         extra = "ignore"

backend/app/services/dashboard_service.py

@@ -17,7 +17,7 @@ class DashboardStats(BaseModel):
 
 async def get_dashboard_stats(db: AsyncSession) -> DashboardStats:
     from app.models.product import Product
-    from app.models.task import Task
+    from app.models.task import Task, TASK_STATUS_PENDING, TASK_STATUS_WIP, TASK_STATUS_COMPLETED
 
     p_total = await db.scalar(select(func.count(Product.id)))
     p_pending = await db.scalar(select(func.count(Product.id)).where(Product.status == "pending"))
@@ -25,9 +25,9 @@ async def get_dashboard_stats(db: AsyncSession) -> DashboardStats:
     p_done = await db.scalar(select(func.count(Product.id)).where(Product.status == "completed"))
 
     t_total = await db.scalar(select(func.count(Task.id)))
-    t_pending = await db.scalar(select(func.count(Task.id)).where(Task.status == "pending"))
-    t_progress = await db.scalar(select(func.count(Task.id)).where(Task.status == "in_progress"))
-    t_done = await db.scalar(select(func.count(Task.id)).where(Task.status == "completed"))
+    t_pending = await db.scalar(select(func.count(Task.id)).where(Task.status == TASK_STATUS_PENDING))
+    t_progress = await db.scalar(select(func.count(Task.id)).where(Task.status == TASK_STATUS_WIP))
+    t_done = await db.scalar(select(func.count(Task.id)).where(Task.status == TASK_STATUS_COMPLETED))
 
     return DashboardStats(
         products_total=p_total or 0,