docs: add secure strategy health sync drop-in

ops/quant-monitor/README.md

@@ -77,7 +77,8 @@ bash scripts/refresh_strategy_health.sh
 的临时输出只在 monitor 数据目录内处理。没有可用输入时输出 `unavailable`，不会生成演示指标。
 
 默认不向外同步。只有在显式设置 `STRATEGY_HEALTH_PUBLISH=1`、专用
-`STRATEGY_HEALTH_SYNC_URL` 和 `STRATEGY_HEALTH_SYNC_TOKEN` 后，才运行：
+`STRATEGY_HEALTH_SYNC_URL`，以及 `STRATEGY_HEALTH_SYNC_TOKEN` 或 root-owned
+`STRATEGY_HEALTH_SYNC_TOKEN_FILE` 后，才运行：
 
 ```bash
 bash scripts/publish_strategy_health.sh

ops/quant-monitor/systemd/codex-quant.service.d/strategy-health-sync.conf.example

@@ -0,0 +1,7 @@
+[Service]
+# Install this as a root-owned drop-in only after the dedicated Worker secret
+# and /etc/codex-quant/strategy-health.sync.token have been provisioned.
+Environment=STRATEGY_HEALTH_PUBLISH=1
+Environment=STRATEGY_HEALTH_SYNC_URL=https://qsl-strategy-switch-console.pigbibi.workers.dev/api/internal/sync-strategy-health
+LoadCredential=strategy-health-sync.token:/etc/codex-quant/strategy-health.sync.token
+Environment=STRATEGY_HEALTH_SYNC_TOKEN_FILE=%d/strategy-health-sync.token

ops/quant-monitor/tests/test_deploy_scripts.py

@@ -104,6 +104,20 @@ def test_deployment_uses_a_dedicated_runtime_checkout(self) -> None:
         self.assertIn(f"WorkingDirectory={runtime_root}/ops/quant-monitor", service)
         self.assertNotIn("/home/ubuntu/Projects/AIAuditBridge", service)
 
+    def test_strategy_health_sync_has_a_separate_root_owned_drop_in_example(self) -> None:
+        drop_in = (
+            ROOT / "systemd" / "codex-quant.service.d" / "strategy-health-sync.conf.example"
+        ).read_text(encoding="utf-8")
+
+        self.assertIn("STRATEGY_HEALTH_PUBLISH=1", drop_in)
+        self.assertIn("/api/internal/sync-strategy-health", drop_in)
+        self.assertIn(
+            "LoadCredential=strategy-health-sync.token:/etc/codex-quant/strategy-health.sync.token",
+            drop_in,
+        )
+        self.assertIn("STRATEGY_HEALTH_SYNC_TOKEN_FILE=%d/strategy-health-sync.token", drop_in)
+        self.assertNotIn("STRATEGY_HEALTH_SYNC_TOKEN=", drop_in)
+
 
 if __name__ == "__main__":
     unittest.main()