feat(auth): support per-deploy login password key override

Multi-replica deployments need every Pod/container to share one RSA private key, otherwise public keys handed to the browser may not match the key that decrypts the resulting ciphertext. Introduce a `*.local.yaml` override layer that ops-config and tenant-config both load on top of the base config, ship example overrides plus compose/k3s wiring, and tolerate PEM bodies that arrive folded or escaped from Secrets.

deploy/ops-config.yaml

@@ -43,6 +43,13 @@ jwt:
   secret: "geo-ops-15645415841"           # 必须通过 OPS_JWT_SECRET 环境变量提供
   access_ttl: 8h
 
+auth:
+  password_cipher:
+    # 生产多实例请在 ops-config.local.yaml 中配置同一把 private_key_pem。
+    enabled: true
+    key_id: ops-password-rsa-oaep-v1
+    private_key_pem: ""
+
 default_admin:
   username: admin
   display_name: 系统管理员