fix(deploy): generate internal tenant key automatically

deploy/dobotai-dingtalk/README.md

@@ -67,6 +67,8 @@ sudo dobotai-dingtalk-configure
 
 配置器要求填写阿里云RDS连接串、WeKnora和钉钉凭证；密钥不回显，环境文件原子写入且权限0600。
 
+`DOBOTAI_TENANT_KEY`不是WeKnora Agent租户键。它是DobotAI内部数据隔离键，首次安装时自动生成并固定保存；配置器不会要求填写或改动它。WeKnora侧只需要在`DOBOTAI_AGENT_BINDINGS`填写实际的Agent ID。
+
 | 配置 | 示例 | 作用 |
 | --- | --- | --- |
 | `DATABASE_URL` | `postgres://USER:***@rds-endpoint:5432/dobotai?sslmode=require` | DobotAI专用阿里云RDS PostgreSQL |

deploy/dobotai-dingtalk/configure_env.py

@@ -11,7 +11,7 @@ FIELDS = (
     ("WEKNORA_BASE_URL", "WeKnora 地址", "应用容器通过宿主机网络访问既有WeKnora。", "http://127.0.0.1:8080", False),
     ("WEKNORA_API_KEY", "WeKnora API Key", "DobotAI专用WeKnora API Key。", "<你的WeKnora API Key>", True),
     ("DOBOTAI_INGRESS_TOKEN", "DobotAI Ingress Token", "调用/v1/qa的独立令牌。", "<随机长字符串>", True),
-    ("DOBOTAI_TENANT_KEY", "DobotAI租户键", "必须与现有DobotAI数据一致。", "dobotai", False),
+
     ("DOBOTAI_AGENT_BINDINGS", "DobotAI Agent Bindings JSON", "钉钉会话到WeKnora Agent映射。", '{"dingtalk:*":"你的Agent ID"}', False),
     ("DINGTALK_CLIENT_ID", "钉钉 Client ID", "钉钉应用Client ID/AppKey。", "dingxxxxxxxx", False),
     ("DINGTALK_CLIENT_SECRET", "钉钉 Client Secret", "钉钉应用Client Secret/AppSecret。", "<你的钉钉 AppSecret>", True),

deploy/dobotai-dingtalk/install-docker.sh

@@ -26,6 +26,7 @@ install -m 0644 "$source_root"/db/migrations/*.up.sql "$container_dir/migrations
 
 if [[ ! -f "$app_env" ]]; then
   umask 077
+  tenant_suffix="$(python3 -c 'import secrets; print(secrets.token_hex(12))')"
   cat > "$app_env" <<'EOF'
 DOBOTAI_LISTEN_ADDR=127.0.0.1:8090
 DATABASE_URL=
@@ -33,13 +34,13 @@ WEKNORA_BASE_URL=http://127.0.0.1:8080
 WEKNORA_API_KEY=
 DOBOTAI_INGRESS_TOKEN=
 DOBOTAI_ADMIN_TOKEN=
-DOBOTAI_TENANT_KEY=dobotai
 DOBOTAI_AGENT_BINDINGS=
 DOBOTAI_QUICK_AGENT_ID=builtin-quick-answer
 DOBOTAI_REASONING_AGENT_ID=builtin-smart-reasoning
 DINGTALK_CLIENT_ID=
 DINGTALK_CLIENT_SECRET=
 EOF
+  printf 'DOBOTAI_TENANT_KEY=dobotai-%s\n' "$tenant_suffix" >> "$app_env"
   chmod 0600 "$app_env"
 fi
 umask 077

scripts/containerized_deployment_test.go

@@ -69,4 +69,14 @@ func TestRDSCredentialConfiguratorPromptsForExternalDatabase(t *testing.T) {
 			t.Errorf("RDS configurator missing %q", required)
 		}
 	}
+	if strings.Contains(source, "DobotAI租户键") {
+		t.Fatal("operator must not be prompted for the internal DobotAI tenant key")
+	}
+	installer, err := os.ReadFile("../deploy/dobotai-dingtalk/install-docker.sh")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(installer), "secrets.token_hex") || !strings.Contains(string(installer), "DOBOTAI_TENANT_KEY=dobotai-") {
+		t.Fatal("installer must generate and persist the internal DobotAI tenant key")
+	}
 }