chore: add wx-qr login config and encrypt exclude paths

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/core/config.py

@@ -153,6 +153,9 @@ class Settings(BaseSettings):
     API_ENCRYPT_FIXED_SECRET: str = ""
     API_ENCRYPT_TS_SKEW_SEC: int = 300
     API_ENCRYPT_NONCE_TTL_SEC: int = 300
+    WX_QR_SESSION_TTL_SEC: int = 180
+    WX_QR_ENV_VERSION: str = "release"  # release | trial | develop
+    WX_QR_PAGE: str = "pages/login/web-qr/index"
     API_ENCRYPT_EXCLUDE_PATHS: str = (
         "/,"
         "/health,"
@@ -167,7 +170,11 @@ class Settings(BaseSettings):
         "/api/web/admin/categories/upload-image,"
         "/api/web/admin/users/upload-avatar,"
         "/api/web/auth/upload-avatar,"
-        "/api/invoice/download"
+        "/api/invoice/download,"
+        "/api/web/auth/wx-qr/create,"
+        "/api/web/auth/wx-qr/status,"
+        "/api/mini/auth/web-qr-scanned,"
+        "/api/mini/auth/web-qr-confirm"
     )
 
     # 中国节假日日历（ailcc）同步