feat: add taro h5 runtime deployment config

scripts/taro-runtime-config-test.js

@@ -0,0 +1,53 @@
+import assert from 'node:assert/strict';
+import { pathToFileURL } from 'node:url';
+
+const repoRoot = process.cwd();
+const envModule = await import(pathToFileURL(`${repoRoot}/apps/taro/src/env.ts`).href);
+
+envModule.applyRuntimeConfig({
+  portal: 'tenant-admin',
+  apiBaseUrl: 'https://api.gongxue100.com///',
+  supabaseUrl: 'https://auth.gongxue100.com///',
+  supabasePublishableKey: 'sb_publishable_public_key',
+  tenantCode: 'tenant-a',
+});
+
+assert.equal(envModule.appEnv.portal, 'tenant-admin');
+assert.equal(envModule.appEnv.apiBaseUrl, 'https://api.gongxue100.com');
+assert.equal(envModule.appEnv.supabaseUrl, 'https://auth.gongxue100.com');
+assert.equal(envModule.appEnv.supabasePublishableKey, 'sb_publishable_public_key');
+assert.equal(envModule.appEnv.tenantCode, 'tenant-a');
+
+envModule.applyRuntimeConfig({
+  TARO_APP_PORTAL: 'platform-admin',
+  TARO_APP_API_BASE_URL: 'https://api2.gongxue100.com',
+});
+
+assert.equal(envModule.appEnv.portal, 'platform-admin');
+assert.equal(envModule.appEnv.apiBaseUrl, 'https://api2.gongxue100.com');
+
+envModule.applyRuntimeConfig({
+  portal: 'invalid-portal',
+  apiBaseUrl: '',
+});
+
+assert.equal(envModule.appEnv.portal, 'platform-admin');
+assert.equal(envModule.appEnv.apiBaseUrl, 'https://api2.gongxue100.com');
+
+assert.throws(
+  () => envModule.applyRuntimeConfig({
+    apiBaseUrl: 'https://api.gongxue100.com',
+    SUPABASE_SERVICE_ROLE_KEY: 'must-not-ship-to-browser',
+  }),
+  /Forbidden secret key in runtime config: SUPABASE_SERVICE_ROLE_KEY/,
+);
+
+assert.throws(
+  () => envModule.applyRuntimeConfig({
+    apiBaseUrl: 'https://api.gongxue100.com',
+    unexpectedFeatureFlag: 'unsafe-drift',
+  }),
+  /Unknown key in runtime config: unexpectedFeatureFlag/,
+);
+
+console.log('[PASS] Taro runtime config guardrails');