feat(install): per-host auto-generated secrets for Docker installs

Each fresh 1Panel/Docker install generates unique MYSQL and NEXUS keys
via scripts/generate_nexus_secrets.py; install wizard reuses compose env.

deploy/install-nexus-fresh.sh

@@ -14,10 +14,9 @@
 #
 #   bash deploy/install-nexus-fresh.sh --profile 4c16g
 #
-# 凭据（任选其一，无需 export）:
-#   - /root/.nexus-deploy.env
-#   - /root/.nexus-secrets/nexus.env
-#   - 仓库内 deploy/nexus-1panel.secrets.sh（私人仓库可 git add -f 后 push）
+# 凭据（仅 Gitea git 用，NEXUS 密钥由安装脚本按机自动生成）:
+#   - /root/.nexus-deploy.env  → NEXUS_GITEA_TOKEN
+#   - deploy/nexus-1panel.secrets.sh 勿放生产 SECRET_KEY（新机勿复用）
 # =============================================================================
 
 set -euo pipefail
@@ -115,8 +114,10 @@ load_credentials() {
         set -a
         source "${NEXUS_ROOT}/deploy/nexus-1panel.secrets.sh"
         set +a
-        info "已加载 ${NEXUS_ROOT}/deploy/nexus-1panel.secrets.sh"
+        info "已加载 ${NEXUS_ROOT}/deploy/nexus-1panel.secrets.sh（仅 git 令牌）"
     fi
+    unset NEXUS_SECRET_KEY NEXUS_API_KEY NEXUS_ENCRYPTION_KEY
+    info "全新安装：NEXUS 密钥将在 docker/.env.prod 中按本机自动生成"
 }
 
 install_root_commands() {