diff --git a/.env.dev b/.env.dev
deleted file mode 100644
index 15bb22f..0000000
--- a/.env.dev
+++ /dev/null
@@ -1,61 +0,0 @@
-# =============================================================================
-# 企微IT智能服务台 — 本地开发环境变量
-# =============================================================================
-# 这是给 docker-compose.dev.yml 用的,不是生产 .env
-# 用法:docker compose -f docker-compose.dev.yml up -d (会自动加载)
-# 安全:此文件可以提交到 git(都是假值,无敏感信息)
-# =============================================================================
-
-# --------------------------------------------------------------------------
-# 关键开关:开发模式
-# --------------------------------------------------------------------------
-# DEV_MODE=true 会启用以下 mock:
-#   1. 跳过企微 OAuth(用 /api/dev/login?userid=xxx 直接登)
-#   2. 默认 userid 设为 dev-user-001
-#   3. 跳过 JS-SDK 签名校验
-#   4. 详细日志输出
-DEV_MODE=true
-
-# --------------------------------------------------------------------------
-# 数据库(Docker 内部用 service name)
-# --------------------------------------------------------------------------
-POSTGRES_USER=wecom
-POSTGRES_PASSWORD=wecom_dev
-POSTGRES_DB=wecom_it_desk_dev
-DATABASE_URL=postgresql://wecom:wecom_dev@localhost:5432/wecom_it_desk_dev
-REDIS_URL=redis://localhost:6379/0
-
-# --------------------------------------------------------------------------
-# 企微(本地用假值,不真调)
-# --------------------------------------------------------------------------
-WECOM_CORP_ID=dev_corp_id_xxxxx
-WECOM_AGENT_ID=1000001
-WECOM_SECRET=dev_secret_placeholder
-WECOM_TOKEN=dev_token_placeholder
-WECOM_ENCODING_AES_KEY=dev_aes_key_43_chars_placeholder_xxxxxxxxx
-
-# --------------------------------------------------------------------------
-# 集成(本地用假值,API 调用会失败但不影响主流程)
-# --------------------------------------------------------------------------
-HUORONG_BASE_URL=http://localhost:9999
-HUORONG_ACCESS_KEY_ID=dev_key
-HUORONG_ACCESS_KEY_SECRET=dev_secret
-LIANRUAN_BASE_URL=http://localhost:9998
-LIANRUAN_API_ACCOUNT=dev
-LIANRUAN_API_PASSWORD=dev
-RAGFLOW_BASE_URL=http://localhost:9997
-RAGFLOW_API_KEY=dev
-
-# --------------------------------------------------------------------------
-# 应用配置
-# --------------------------------------------------------------------------
-APP_ENV=development
-LOG_LEVEL=DEBUG
-CORS_ORIGINS=http://localhost:5173,http://localhost:5174,http://localhost:5175,http://localhost:5176
-
-# --------------------------------------------------------------------------
-# Mock 用户(DEV_MODE=true 时)
-# --------------------------------------------------------------------------
-DEV_DEFAULT_USERID=dev-user-001
-DEV_DEFAULT_NAME=开发测试用户
-DEV_DEFAULT_DEPT=信息技术部
diff --git a/.gitignore b/.gitignore
index 8b86b66..ce7fc72 100644
--- a/.gitignore
+++ b/.gitignore
@@ -142,3 +142,81 @@ wecom-it-desk-server-deploy.zip
 .workbuddy/*.log.err
 # workbuddy 记忆目录(个人上下文,不 入仓)
 .workbuddy/memory/
+
+# =============================================================================
+# 工作树清理 (2026-07-09): 产物 / 临时 / 上传 / 调试 dump 不入仓
+# 说明: 仅停止版本跟踪, 文件保留在磁盘 (git rm --cached), 全部可逆
+# =============================================================================
+
+# 部署/构建产物 zip (体积大, 含 dist)
+*.zip
+*-dist/
+
+# 压缩包 / 备份 dump
+*.tar.xz
+*.dump
+
+# 后端运行时上传 (员工上传的 pdf/png, 非源码)
+backend/media/files/
+backend/media/images/
+
+# 调试 dump
+backend/*_dump.txt
+backend/all_routes.txt
+backend/auto_routes.txt
+backend/route_dump*.txt
+backend/api_router_dump.txt
+
+# 根目录 scratch 脚本 (一次性修复/检查/测试)
+check_*.py
+fix_*.py
+extract_and_migrate.py
+update_password.py
+upload_*.py
+_ctrt_transform.py
+encoded_knowledge_suggestion.txt
+deploy_to_container.py
+test_login*.py
+test_login*.json
+test_login*.sh
+test_redis*.py
+test_redis*.sh
+test_send.sh
+test_redis_conn.py
+keep_alive.ps1
+start_backend.sh
+start_dev_services.bat
+start_dev_services.ps1
+otp-bind.sh
+
+# 部署 scratch
+deploy-*.bat
+deploy-staging/
+deploy-scripts/
+deploy-temp/
+chunks/
+dify/
+ragflow/
+neo4j5*
+
+# nginx 实验配置 (nginx/nginx.dev.conf 如需则解除忽略)
+nginx*.conf
+nginx.conf.bak
+itdesk-nginx-block.conf
+
+# 截图 / 录屏
+login_*.png
+login_shot.mjs
+docs/06-测试质量/e2e-screenshots/
+
+# base64 头 dump
+*_b64_head.txt
+
+# scratch SQL (一次性)
+disable_mfa.sql
+check_sxn.sql
+reset_pass.sql
+reset_pwd.sql
+
+# 杂项
+-w
diff --git a/agent-deploy.zip b/agent-deploy.zip
deleted file mode 100644
index bb32553..0000000
Binary files a/agent-deploy.zip and /dev/null differ
diff --git a/agent-dist-new.zip b/agent-dist-new.zip
deleted file mode 100644
index b470628..0000000
Binary files a/agent-dist-new.zip and /dev/null differ
diff --git a/agent-dist.zip b/agent-dist.zip
deleted file mode 100644
index 6d3b17e..0000000
Binary files a/agent-dist.zip and /dev/null differ
diff --git a/disable_mfa.sql b/disable_mfa.sql
deleted file mode 100644
index ec42d99..0000000
--- a/disable_mfa.sql
+++ /dev/null
@@ -1 +0,0 @@
-UPDATE agents SET mfa_enabled = false WHERE user_id = 'sxn';