fix security and import validation

server/db.js

@@ -1,5 +1,4 @@
 const Database = require('better-sqlite3');
-const bcrypt = require('bcryptjs');
 const path = require('path');
 const logger = require('./utils/logger');
 
@@ -108,11 +107,17 @@ function migrateAddRebateColumn() {
  * 初始化默认用户
  */
 function initDefaultUser() {
+  if (process.env.NODE_ENV === 'production') {
+    logger.info('生产环境跳过默认用户初始化');
+    return;
+  }
+
   const existingUser = db.prepare('SELECT id FROM users WHERE username = ?').get('lizhilun');
   if (!existingUser) {
+    const bcrypt = require('bcryptjs');
     const hash = bcrypt.hashSync('lizhilun', 10);
     db.prepare('INSERT INTO users (username, password) VALUES (?, ?)').run('lizhilun', hash);
-    logger.info('默认用户 lizhilun 已创建');
+    logger.info('开发默认用户 lizhilun 已创建');
   }
 }