feat(packaging): 单元与安装包改为配置文件启动，口令不再写入 ExecStart

所有交付形态统一成「只传 -config」，凭据留在配置文件 / secrets 文件里。

- systemd 单元：ExecStart 改为 `-config /etc/webui4frpc/config.json`，
  EnvironmentFile 加 `-` 前缀变成可选；新增 ReadOnlyPaths=-/etc/webui4frpc/secret。
- 新增 packaging/common/config.json 示例：口令默认用
  file:/etc/webui4frpc/secret/password 引用，内嵌以 "_" 开头的说明键。
- webui4frpc.env 瘦身为可选环境变量（${VAR} 取值来源），不再承载明文口令。
- deb/rpm：安装 config.json 与 0750 的 secret 目录，config.json 进 conffiles，
  安装后提示改成「设置 password 文件」。
- release.sh 的分发单元模板同步改 -config；tar.gz 附 config.json.example。
- macOS pkg：写 config.json + secret/password，launch 包装脚本只传 -config。
- Windows NSIS：安装时把口令写进 secret-password.txt（icacls 限制为
  SYSTEM/Administrators），生成 data/config.json 用 file: 引用，启动脚本只传
  -config；顺带按 JSON 规则转义 addr/user。makensis 实测可编译通过。

packaging/common/config.json

@@ -0,0 +1,27 @@
+{
+  "_comment": [
+    "webui4frpc startup config. Every field is optional; the effective",
+    "precedence is: command-line flag > this file > built-in default.",
+    "",
+    "Password handling (pick ONE, do not put a literal password here):",
+    "  \"password\": \"file:/etc/webui4frpc/secret/password\"   first line of a 0640 root:webui4frpc file",
+    "  \"password\": \"${W4F_PASSWORD}\"                        from the environment (unset => refuses to start)",
+    "",
+    "Unknown keys are a hard error, so a typo cannot silently fall back to the",
+    "built-in default credentials. The file may be absent (pure-flag mode)."
+  ],
+  "addr": "0.0.0.0:7500",
+  "user": "admin",
+  "password": "file:/etc/webui4frpc/secret/password",
+  "workdir": "/var/lib/webui4frpc",
+
+  "_optional": [
+    "bin     - initial frpc binary path, seeded into settings on first start",
+    "frpc    - fallback worker frpc path when settings has none",
+    "peers   - cluster peer host:port list (same as repeating -peer)",
+    "join_key- cluster admission key = sponsor node's nodeKey (or ${W4F_JOIN_KEY})"
+  ],
+  "frpc": "",
+  "peers": [],
+  "join_key": ""
+}

packaging/common/webui4frpc.env

@@ -1,8 +1,28 @@
-# webui4frpc runtime configuration
-# 默认监听全部接口的 7500 端口；请修改密码后再投入生产。
-W4F_ADDR=0.0.0.0:7500
-W4F_USER=admin
-W4F_PASSWORD=admin
+# webui4frpc optional environment file.
+#
+# Listening address, admin credentials, workdir and peers now belong in
+# /etc/webui4frpc/config.json — that file is what systemd passes via
+# `webui4frpc -config ...`, and it keeps the password out of the unit file and
+# out of `ps` output.
+#
+# Everything here is OPTIONAL; the unit uses `EnvironmentFile=-`, so this file
+# may be empty or missing entirely.
+#
+# Referenced by config.json as ${VAR} (the variable must be set and non-empty,
+# otherwise startup fails loudly rather than booting with an empty password):
+# W4F_PASSWORD=change-me
+#
+# Cluster admission key, used by config.json as "join_key": "${W4F_JOIN_KEY}".
+# W4F_JOIN_KEY=
+#
+# Overrides the advertised hostname for peers (container DNS / wildcard listen).
+# W4F_HOST=
+#
+# Load balancing defaults (the per-node switch in the UI wins over these).
+# W4F_BALANCE_MODE=dry-run
+# W4F_BALANCE_COOLDOWN=600
+# W4F_BALANCE_INTERVAL=10
 
-# 可选：首次提供的 frpc 二进制路径（留空则从 Web UI 手动/自动安装）
-# W4F_FRPC=/usr/local/bin/frpc
+# Optional: point at a config file outside /etc/webui4frpc. An explicit
+# -config flag still wins over this.
+# W4F_CONFIG=/etc/webui4frpc/config.json

packaging/common/webui4frpc.service

@@ -8,8 +8,15 @@ Wants=network-online.target
 Type=simple
 User=webui4frpc
 Group=webui4frpc
-EnvironmentFile=/etc/webui4frpc/webui4frpc.env
-ExecStart=/usr/bin/webui4frpc -addr ${W4F_ADDR} -user ${W4F_USER} -password ${W4F_PASSWORD} -workdir /var/lib/webui4frpc
+# The listening address, admin credentials and cluster peers live in
+# config.json, NOT on the command line: anything in ExecStart is visible to
+# every user via `ps` and in the unit file itself. Keep the password out of
+# this unit — put it in config.json as "file:/etc/webui4frpc/secret/password"
+# (or "${W4F_PASSWORD}" with an EnvironmentFile), never as -password.
+# The leading "-" makes the EnvironmentFile optional, so a node that keeps all
+# settings in config.json still starts.
+EnvironmentFile=-/etc/webui4frpc/webui4frpc.env
+ExecStart=/usr/bin/webui4frpc -config /etc/webui4frpc/config.json
 Restart=always
 RestartSec=5
 LimitNOFILE=65535
@@ -20,6 +27,10 @@ PrivateTmp=true
 ProtectSystem=full
 ProtectHome=true
 ReadWritePaths=/var/lib/webui4frpc
+# config.json may point at a root-only secrets file for the admin password.
+# That path needs to be readable by this service account; keep such files in
+# /etc/webui4frpc/secret/ with mode 0640 root:webui4frpc.
+ReadOnlyPaths=-/etc/webui4frpc/secret
 
 [Install]
 WantedBy=multi-user.target