fix(update): 修复云端安装交接并完善发布验收

修复隐藏缓存目录下载和响应收尾，使用原生助手校验安装包并确认交接。
补齐真实静默升级、便携版及中文路径验收，并按现行设备和科目授权契约更新回归。
服务端安装时生成独立密钥，覆盖升级保留既有配置；补齐安装包副本验证说明。

scripts/verify-server-bootstrap.mjs

@@ -0,0 +1,37 @@
+/** 验证安装副本生成独立密钥，并在覆盖升级和重复启动时保留配置。 */
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const { initialiseEnvironment, MARKER } = require('../deploy/bootstrap-env.cjs');
+const root = fs.mkdtempSync(path.resolve('.cache/server-bootstrap-'));
+const template = '# test\nJWT_SECRET=' + MARKER + '\nPORT=4000\n';
+const first = path.join(root, 'first.env');
+const second = path.join(root, 'second.env');
+for (const file of [first, second]) fs.writeFileSync(file, template);
+assert.equal(initialiseEnvironment(first), true);
+assert.equal(initialiseEnvironment(second), true);
+const key = (file) => fs.readFileSync(file, 'utf8').match(/^JWT_SECRET=(.+)$/m)?.[1];
+assert.match(key(first), /^[a-f0-9]{96}$/);
+assert.match(key(second), /^[a-f0-9]{96}$/);
+assert.notEqual(key(first), key(second));
+console.log('PASS 每个首次安装副本生成独立的随机密钥');
+const before = fs.readFileSync(first);
+assert.equal(initialiseEnvironment(first), false);
+assert.deepEqual(fs.readFileSync(first), before);
+console.log('PASS 重复启动保留既有密钥及全部配置');
+const existing = path.join(root, 'existing.env');
+const config = 'JWT_SECRET=existing-private-key\r\nPORT=4400\r\n';
+fs.writeFileSync(existing, config);
+assert.equal(initialiseEnvironment(existing), false);
+assert.equal(fs.readFileSync(existing, 'utf8'), config);
+console.log('PASS 覆盖升级不旋转用户原有密钥');
+const crlf = path.join(root, 'crlf.env');
+fs.writeFileSync(crlf, template.replaceAll('\n', '\r\n'));
+assert.equal(initialiseEnvironment(crlf), true);
+assert.match(key(crlf), /^[a-f0-9]{96}\r?$/);
+console.log('PASS Windows 换行模板初始化成功');
+assert.throws(() => initialiseEnvironment(path.join(root, 'missing.env')), { code: 'ENOENT' });
+console.log('PASS 缺少配置时失败，不生成隐含默认配置');
+console.log('5/5 服务端配置初始化验证通过');