feat: add A-card operations frontend and backend foundation

.env.example

@@ -13,8 +13,27 @@ MYSQL_USER=root
 MYSQL_PASSWORD=change-me
 MYSQL_DATABASE=model_platform
 DATABASE_URL=mysql+asyncmy://root:change-me@127.0.0.1:3306/model_platform?charset=utf8mb4
+# 运维模块独立库；省略时后端自动复用 DATABASE_URL 的账号和主机，
+# 仅将数据库名切换为 model_operations。
+OPERATIONS_DATABASE_URL=mysql+asyncmy://root:change-me@127.0.0.1:3306/model_operations?charset=utf8mb4
+# 运维模块访问另外两库时使用专用只读 Session；生产建议配置 DBA
+# 创建的只读账号，不要复用 root。
+PLATFORM_READ_DATABASE_URL=mysql+asyncmy://readonly:change-me@127.0.0.1:3306/model_platform?charset=utf8mb4
+DEPLOY_DATABASE_URL=mysql+asyncmy://readonly:change-me@127.0.0.1:3306/model_deploy?charset=utf8mb4
+
+# Redis is an optional accelerator: cache + Streams only. MySQL Outbox remains
+# the reliable source of truth when Redis is unavailable.
+REDIS_URL=redis://127.0.0.1:6379/0
+OPERATIONS_CACHE_TTL_SECONDS=300
+OPERATIONS_REDIS_PREFIX=model-platform:operations
+OPERATIONS_EVENT_STREAM=model-platform:operations:events
+OPERATIONS_EVENT_STREAM_MAXLEN=10000
+OPERATIONS_DATA_MODE=database
 
 JWT_SECRET=change-this-development-secret
+# AES-256 configuration decryption key used only when a value is wrapped in ENC(...).
+# Replace before deployment; keep the same value across all four services.
+APP_CONFIG_SECRET_KEY=change-this-config-secret-key
 
 # Force the Secure flag on the session cookie even when the inbound request
 # scheme is plain HTTP. Enable behind a TLS-terminating reverse proxy that