chore: 补 S4 启用与配置合并的运维脚本

- scripts/patch_env.py：把 KEY=VALUE 文件合并进 .env，只回显键名与长度，不回显密钥
- scripts/check_s4.py：在生产机上验证「预签名 → PUT → 公开读回」整条直传链路
- .env.example：注明本地后端连生产库时 HASHID_SECRET 必须与线上一致
  （不一致会把线上 brand_uid 解码成另一个 id，任务被判 brand not found）

scripts/patch_env.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+"""把 KEY=VALUE 文件里的键合并进目标 .env（存在则替换，不存在则追加）。
+
+用途：在不把密钥回显到终端的前提下，更新服务器上的生产配置。
+用法：python3 patch_env.py <kv文件> <目标.env>
+"""
+import re
+import sys
+
+
+def main() -> int:
+    if len(sys.argv) != 3:
+        print("用法: patch_env.py <kv文件> <目标.env>")
+        return 2
+    kv_path, env_path = sys.argv[1], sys.argv[2]
+
+    kv = {}
+    with open(kv_path, encoding="utf-8") as fh:
+        for line in fh:
+            line = line.strip()
+            if not line or "=" not in line or line.startswith("#"):
+                continue
+            key, value = line.split("=", 1)
+            kv[key.strip()] = value
+
+    with open(env_path, encoding="utf-8") as fh:
+        lines = fh.read().splitlines()
+
+    seen = set()
+    out = []
+    for line in lines:
+        m = re.match(r"^([A-Z0-9_]+)=", line)
+        if m and m.group(1) in kv:
+            key = m.group(1)
+            out.append(f"{key}={kv[key]}")
+            seen.add(key)
+        else:
+            out.append(line)
+    for key, value in kv.items():
+        if key not in seen:
+            out.append(f"{key}={value}")
+
+    with open(env_path, "w", encoding="utf-8") as fh:
+        fh.write("\n".join(out) + "\n")
+
+    # 只打印键名与长度，绝不打印值
+    for key in sorted(kv):
+        print(f"  {key}: {'已更新' if key in seen else '已追加'} 长度={len(kv[key])}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())