fix: 收紧演示模式与刷新预限流

.env.example

@@ -1,5 +1,6 @@
 # Copy this file to .env and replace test-only values for non-test environments.
 NODE_ENV=production
+APP_ENV=production
 DEMO_SMS_CODE_ENABLED=false
 DATABASE_URL=postgresql://drift:drift_test_only@127.0.0.1:55432/drift_bottle_test?schema=public
 REDIS_URL=redis://127.0.0.1:56379
@@ -13,6 +14,9 @@ JWT_ISSUER=drift-api
 JWT_AUDIENCE=drift-web
 ACCESS_TOKEN_TTL_SECONDS=900
 REFRESH_TOKEN_TTL_SECONDS=2592000
+REFRESH_ATTEMPT_IP_LIMIT=30
+REFRESH_ATTEMPT_IP_WINDOW_SECONDS=60
+REFRESH_RATE_LIMIT=60
 SMS_CODE_TTL_SECONDS=300
 REDIS_KEY_PREFIX=drift:auth:
 TRUST_PROXY=false