fix(auth): harden password verification against timing attacks

- Run dummy hash when user is not found to prevent timing-based enumeration
- Extract and log real client IP on login requests
- Remove unused test files
- Reorder application config for clarity

build.gradle.kts

@@ -44,3 +44,8 @@ kotlin {
 tasks.withType<Test> {
     useJUnitPlatform()
 }
+
+// 打包时排除dev环境配置
+tasks.named<ProcessResources>("processResources") {
+    exclude("application-dev.yaml")
+}