chore: 上线前加固——调度器/登录限流/env 模板补全

- routes/console.php：注册每日数据库备份（03:00）+ 前台页面缓存清理（04:00）
- 前台登录/注册 POST 加 throttle:6,1 防爆破
- .env.example 补 S3/LLM/MARKET/UPLOAD_DISK 配置项，新部署不再漏配

routes/console.php

@@ -1,8 +1,21 @@
 <?php
 
-use Illuminate\Foundation\Inspiring;
-use Illuminate\Support\Facades\Artisan;
+declare(strict_types=1);
 
-Artisan::command('inspire', function () {
-    $this->comment(Inspiring::quote());
-})->purpose('Display an inspiring quote');
+use Illuminate\Support\Facades\Schedule;
+
+/*
+|--------------------------------------------------------------------------
+| 调度器（生产需配置 cron：* * * * * php artisan schedule:run）
+|--------------------------------------------------------------------------
+*/
+
+// 数据库每日备份（保留 7 天；spatie/laravel-backup）
+Schedule::command('backup:run --only-db')
+    ->dailyAt('03:00')
+    ->withoutOverlapping()
+    ->appendOutputTo(storage_path('logs/backup.log'));
+
+// 每日清理前台页面缓存（避免旧缓存长期驻留）
+Schedule::call(fn () => \App\Blog\Support\PageCacheMiddleware::flush())
+    ->dailyAt('04:00');

routes/web.php

@@ -66,15 +66,15 @@ Route::get('/comments', fn () => redirect()->route('comments', [], 301));
 
 Route::get('/login.shtml', [AuthController::class, 'showLogin'])->name('login');
 Route::get('/login', fn () => redirect()->route('login', [], 301));
-Route::post('/login.shtml', [AuthController::class, 'login']);
-Route::post('/login', [AuthController::class, 'login']);
+Route::post('/login.shtml', [AuthController::class, 'login'])->middleware('throttle:6,1');
+Route::post('/login', [AuthController::class, 'login'])->middleware('throttle:6,1');
 Route::post('/logout.shtml', [AuthController::class, 'logout'])->name('logout');
 Route::post('/logout', [AuthController::class, 'logout']);
 
 Route::get('/register.shtml', [AuthController::class, 'showRegister'])->name('register');
 Route::get('/register', fn () => redirect()->route('register', [], 301));
-Route::post('/register.shtml', [AuthController::class, 'register']);
-Route::post('/register', [AuthController::class, 'register']);
+Route::post('/register.shtml', [AuthController::class, 'register'])->middleware('throttle:6,1');
+Route::post('/register', [AuthController::class, 'register'])->middleware('throttle:6,1');
 
 Route::get('/profile.shtml', [AuthController::class, 'profile'])->middleware('auth')->name('profile');
 Route::get('/profile', fn () => redirect()->route('profile', [], 301))->middleware('auth');