chore: baseline V8.10.0-dev.1 with v8_workflows type-mapping fix and trade-pro spec

- SiteForge Enterprise V8.10.0-dev.1 upstream source (210 tests)
- Fix: v8_workflows._mapped_input now reads both 类型/分类 columns so WXR
  imports keep post/product types instead of collapsing to page
- Docs: trade-pro theme port spec (R3) and implementation plan

Co-Authored-By: Claude Code <noreply@anthropic.com>

app/secret_refs.py

@@ -0,0 +1,37 @@
+"""Secret references: no literal secret values in persisted configuration.
+
+Environment references are intended for single-host development. Production
+should mount secrets under /run/secrets via Docker/Kubernetes secret volumes.
+"""
+import os
+import re
+from pathlib import Path
+
+ROOT=Path('/run/secrets')
+class SecretReferenceError(ValueError):pass
+
+def resolve(ref:str)->str:
+    if not isinstance(ref,str) or len(ref)>160:raise SecretReferenceError('Invalid secret reference')
+    if ref.startswith('env:'):
+        key=ref[4:]
+        if not re.fullmatch(r'SITEFORGE_[A-Z][A-Z0-9_]{1,110}',key):
+            raise SecretReferenceError('Environment secret name must be SITEFORGE_*')
+        val=os.environ.get(key,'')
+    elif ref.startswith('file:'):
+        name=ref[5:]
+        if not re.fullmatch(r'[a-zA-Z0-9_.-]{1,90}',name) or name.startswith('.'):
+            raise SecretReferenceError('Invalid secret filename')
+        path=(ROOT/name).resolve()
+        if path.parent!=ROOT or not path.is_file():raise SecretReferenceError('Secret unavailable')
+        val=path.read_text(encoding='utf-8').strip()
+    else:
+        raise SecretReferenceError('Expected env: or file: secret reference')
+    if not val:raise SecretReferenceError('Secret is empty or unavailable')
+    return val
+
+def validate_reference(ref:str)->str:
+    """Validate a reference without resolving the credential in the Web process."""
+    if not isinstance(ref,str) or len(ref)>160:raise SecretReferenceError('Invalid secret reference')
+    if ref.startswith('env:') and re.fullmatch(r'SITEFORGE_[A-Z][A-Z0-9_]{1,110}',ref[4:]):return ref
+    if ref.startswith('file:') and re.fullmatch(r'[a-zA-Z0-9][a-zA-Z0-9_.-]{0,89}',ref[5:]):return ref
+    raise SecretReferenceError('Expected env:SITEFORGE_* or file:<name> secret reference')