[16yunH]

Summary

• remove the exposed AMap credential from current source and tracked caches, load replacement configuration from environment variables, and document key rotation
• correct directed routing, one-way handling, road projection, and same-segment routes; add regression tests
• harden frontend/backend boundaries against popup XSS, invalid coordinates, permissive CORS, hard-coded paths, and leaked exception details
• remove tracked dependencies, IDE metadata, and build output; migrate the frontend from Vue CLI to Vite and add CI

Root causes

The AMap key was hard-coded in application source while generated dependency caches were committed. Routing also used backward traversal over outgoing edges, which is invalid for directed roads, and runtime configuration was tied to one development machine.

Verification

• npm ci --ignore-scripts
• npm audit --omit=dev --audit-level=high (0 vulnerabilities)
• npm run lint
• npm run build
• direct C++17 compilation of backend server and regression tests
• MapNavigationTests (all pathfinder regressions passed)
• backend HTTP smoke tests for network info, valid route, and invalid coordinates
• current-tree scan for the exposed AMap key (no matches)
• post-implementation Standards and Spec reviews (all findings addressed)

Deployment note

The exposed AMap key still exists in Git history and must be revoked or rotated in the AMap console. This PR intentionally avoids rewriting shared Git history.

Local CMake execution was unavailable on the author's machine; the added GitHub Actions job performs the CMake configure, build, and CTest flow on Ubuntu.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum diff size. Try reducing the number of changed files and lines, and requesting a review from Copilot again.