fix(legal): add default user agreement + privacy policy to branding config

The /api/settings/brand-config endpoint was returning empty legal fields
(user_agreement_url, privacy_policy_url, user_agreement_text,
privacy_policy_text all blank). This is a compliance gap for a trading
platform handling real funds.

- branding.py: add legal defaults to BRAND_DEFAULTS (summary text + URLs
  pointing to /legal/user-agreement and /legal/privacy-policy), so the
  public brand-config API returns non-empty legal metadata out of the box
- env.example: fill in the BRAND_LEGAL_* defaults so operators see the
  expected values

Author: Thranduil

backend_api_python/app/services/settings/branding.py

@@ -18,6 +18,20 @@
     "social_discord": "https://discord.com/invite/tyx5B6TChr",
     "social_telegram": "https://t.me/quantdinger",
     "social_youtube": "https://youtube.com/@quantdinger",
+    "legal_user_agreement_url": "/legal/user-agreement",
+    "legal_user_agreement_text": (
+        "QuantDinger 用户协议(摘要)。本平台为量化研究、回测与自动化交易提供基础设施,"
+        "所有 AI 产出仅供研究参考,不构成任何投资建议。用户使用本平台进行实盘交易的风险"
+        "由用户自行承担。对接第三方券商/交易所前,用户须确认已阅读该平台的服务条款与"
+        "风险规则。严禁使用本平台从事任何违法违规交易活动。"
+    ),
+    "legal_privacy_policy_url": "/legal/privacy-policy",
+    "legal_privacy_policy_text": (
+        "隐私政策(摘要)。QuantDinger 仅收集为提供服务所必需的最少数据,包括登录凭证、"
+        "券商 API 授权信息(加密存储)、会话与操作日志。除法律强制要求外,我们不会向"
+        "第三方出售用户数据。用户可随时申请导出或删除其数据。券商 API Key/Secret "
+        "采用 AES-256 加密存储,前端仅展示掩码。"
+    ),
 }
 
 
@@ -50,10 +64,22 @@ def build_brand_config(app_version: str) -> Dict[str, object]:
         },
         "social_accounts": social_accounts,
         "legal": {
-            "user_agreement_url": brand_env("BRAND_LEGAL_USER_AGREEMENT_URL"),
-            "user_agreement_text": brand_env("BRAND_LEGAL_USER_AGREEMENT_TEXT"),
-            "privacy_policy_url": brand_env("BRAND_LEGAL_PRIVACY_POLICY_URL"),
-            "privacy_policy_text": brand_env("BRAND_LEGAL_PRIVACY_POLICY_TEXT"),
+            "user_agreement_url": brand_env(
+                "BRAND_LEGAL_USER_AGREEMENT_URL",
+                "legal_user_agreement_url",
+            ),
+            "user_agreement_text": brand_env(
+                "BRAND_LEGAL_USER_AGREEMENT_TEXT",
+                "legal_user_agreement_text",
+            ),
+            "privacy_policy_url": brand_env(
+                "BRAND_LEGAL_PRIVACY_POLICY_URL",
+                "legal_privacy_policy_url",
+            ),
+            "privacy_policy_text": brand_env(
+                "BRAND_LEGAL_PRIVACY_POLICY_TEXT",
+                "legal_privacy_policy_text",
+            ),
         },
         "mobile_app": {
             "latest_version": brand_env("MOBILE_APP_LATEST_VERSION"),

backend_api_python/env.example

@@ -37,10 +37,10 @@ BRAND_SOCIAL_YOUTUBE=https://youtube.com/@quantdinger
 
 # Legal: external URL takes priority; if both URL and inline text are empty,
 # the frontend falls back to the built-in i18n copy.
-BRAND_LEGAL_USER_AGREEMENT_URL=
-BRAND_LEGAL_USER_AGREEMENT_TEXT=
-BRAND_LEGAL_PRIVACY_POLICY_URL=
-BRAND_LEGAL_PRIVACY_POLICY_TEXT=
+BRAND_LEGAL_USER_AGREEMENT_URL=/legal/user-agreement
+BRAND_LEGAL_USER_AGREEMENT_TEXT=QuantDinger 用户协议(摘要)。本平台为量化研究、回测与自动化交易提供基础设施,所有 AI 产出仅供研究参考,不构成任何投资建议。用户使用本平台进行实盘交易的风险由用户自行承担。对接第三方券商/交易所前,用户须确认已阅读该平台的服务条款与风险规则。严禁使用本平台从事任何违法违规交易活动。
+BRAND_LEGAL_PRIVACY_POLICY_URL=/legal/privacy-policy
+BRAND_LEGAL_PRIVACY_POLICY_TEXT=隐私政策(摘要)。QuantDinger 仅收集为提供服务所必需的最少数据,包括登录凭证、券商 API 授权信息(加密存储)、会话与操作日志。除法律强制要求外,我们不会向第三方出售用户数据。用户可随时申请导出或删除其数据。券商 API Key/Secret 采用 AES-256 加密存储,前端仅展示掩码。
 
 # =========================
 # Auth (required)