第六阶段开发。

dev/.env.example

@@ -42,6 +42,48 @@ APT_PROBE_TIMEOUT_MS=2000
 # Keep false in production; a non-local profile with true fails startup.
 APT_MASTER_CLIENT_MOCK=false
 
+# ---- SIP voice / AMI (disabled by default) ----
+# Master switch; AMI host/port/user/timeouts live in table apt_ast_instance.
+# Keep false until a reachable Asterisk exists — false means "no connection, no SIP call",
+# and the scan task only handles the tablet chain.
+APT_VOICE_ENABLED=false
+# Auto-dial when jcsj is due; false = only manual POST /apt/jcxx/{jcid}/dial
+APT_VOICE_SIP_CALL_ENABLED=true
+# Duty desk extensions (second leg), comma separated, e.g. 1002,1003; empty = room leg only
+APT_VOICE_DUTY_EXTENSIONS=
+APT_VOICE_TTS_CONTEXT=apt-tts
+APT_VOICE_TTS_EXTENSION=s
+APT_VOICE_TTS_MEDIA_PREFIX=apt/call-prompt
+APT_VOICE_DIAL_TIMEOUT_MS=30000
+
+# ---- AMI secret (process env only) ----
+# apt_ast_instance.ami_secret_ref stores the VARIABLE NAME only (default APT_AMI_SECRET).
+# The value must match manager.conf accounts; it is never written to DB, logs or git.
+# Missing value -> AmiException(AMI_CONFIG_MISSING), instance stays DOWN, startup is unaffected.
+APT_AMI_SECRET=<required: AMI secret, injected by process env only>
+
+# ---- Device auth for /open/v1/** ----
+# Production must keep true; local debugging may set false (only X-Device-Code is checked).
+APT_DEVICE_HMAC_ENABLED=true
+APT_DEVICE_HMAC_SECRET=<required: shared HMAC secret, injected by process env only>
+
+# ---- Local debug endpoints (/apt/local/**, must stay false in production) ----
+# true exposes: inject #7 match verdict, inject AMI events (bypasses real entry points).
+APT_DEBUG_ENABLED=false
+
+# ---- Tablet face photo storage (paths only in DB, image on disk/OSS) ----
+# Writable directory; DB stores relative path face/{gyid}/{yyyy}/{MM}/{dd}/{jcid}/{photoId}.jpg
+APT_PHOTO_ROOT=./data/apt-photos
+# Per-file limit in bytes (must be <= spring.servlet.multipart.max-file-size, currently 10MB)
+APT_PHOTO_MAX_BYTES=5242880
+# Prefix used only when echoing a URL back to the tablet
+APT_PHOTO_PUBLIC_PREFIX=/apt/files
+APT_PHOTO_STORAGE_TARGET=LOCAL
+# Retention: photo records and files older than N days are purged daily at 03:30
+# (business cap = 1 month; keep default 30 unless ops asks otherwise)
+APT_PHOTO_RETENTION_DAYS=30
+APT_PHOTO_PURGE_BATCH=200
+
 # ---- Druid console (disabled by default) ----
 APT_DRUID_CONSOLE=false
 APT_DRUID_USER=aptadmin