feat: scaffold taro h5 frontends

apps/taro/src/env.ts

@@ -0,0 +1,31 @@
+export type Portal = 'student' | 'tenant-admin' | 'platform-admin';
+
+declare const process: {
+  env: Record<string, string | undefined>;
+};
+
+export const appEnv = {
+  portal: (process.env.TARO_APP_PORTAL || 'student') as Portal,
+  apiBaseUrl: process.env.TARO_APP_API_BASE_URL || 'http://127.0.0.1:8787',
+  supabaseUrl: process.env.TARO_APP_SUPABASE_URL || '',
+  supabasePublishableKey: process.env.TARO_APP_SUPABASE_PUBLISHABLE_KEY || '',
+  tenantCode: process.env.TARO_APP_TENANT_CODE || '',
+};
+
+export function assertFrontendSecretsAreAbsent() {
+  const forbidden = [
+    'SUPABASE_SERVICE_ROLE_KEY',
+    'SUPABASE_SECRET_KEY',
+    'DATABASE_URL',
+    'ALIYUN_OSS_ACCESS_KEY_SECRET',
+    'TENCENT_COS_SECRET_KEY',
+    'WECHAT_PAY_PRIVATE_KEY',
+    'ALIPAY_APP_PRIVATE_KEY',
+    'AUTH_SESSION_SECRET',
+    'PLATFORM_ADMIN_API_KEY',
+  ];
+  const leaked = forbidden.filter(key => process.env[key]);
+  if (leaked.length) {
+    throw new Error(`Forbidden secret env in Taro build: ${leaked.join(', ')}`);
+  }
+}