fix(security): harden deployment configuration boundaries

apps/miniprogram/miniprogram/app.ts

@@ -1,6 +1,7 @@
 App<IAppOption>({
   globalData: {
-    // 本地开发地址；提审/发布前必须替换为已配置微信合法域名的 HTTPS API 地址。
+    // 本地开发使用回环地址；体验版/正式版会由请求层拒绝非 HTTPS 地址。
+    // 提审前必须替换为已配置微信合法域名的 HTTPS API 地址。
     apiBaseUrl: 'http://localhost:3000',
   },
 });

apps/miniprogram/miniprogram/services/api-client.ts

@@ -7,6 +7,35 @@ function resolveApiBaseUrl(): string {
   return stored || getApp<IAppOption>().globalData.apiBaseUrl.trim();
 }
 
+function assertSafeApiUrl(url: string): void {
+  if (!url) return;
+  const normalized = url.toLowerCase().replace(/\/$/, '');
+  const isDevelopment = (() => {
+    try {
+      return wx.getAccountInfoSync().miniProgram.envVersion === 'develop';
+    } catch {
+      return false;
+    }
+  })();
+  const isDevelopmentLoopback =
+    isDevelopment && /^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(normalized);
+  if (isDevelopmentLoopback) return;
+  if (/^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:\d+)?$/.test(normalized)) {
+    throw new MiniProgramApiError(
+      'API 地址包含内网地址，拒绝连接，请检查配置',
+      'CONFIGURATION_ERROR',
+      null,
+    );
+  }
+  if (!url.startsWith('https://')) {
+    throw new MiniProgramApiError(
+      'API 地址必须使用 HTTPS，当前地址不安全',
+      'CONFIGURATION_ERROR',
+      null,
+    );
+  }
+}
+
 type ApiRequestOptions = Omit<
   WechatMiniprogram.RequestOption,
   'url' | 'success' | 'fail' | 'complete'
@@ -33,6 +62,7 @@ export function apiRequest<T>(path: string, options: ApiRequestOptions = {}): Pr
       ),
     );
   }
+  assertSafeApiUrl(apiBaseUrl);
   return new Promise((resolve, reject) => {
     const session = readSession();
     wx.request<ApiSuccessResponse<T> | ApiErrorResponse>({