chore: bind sensitive config to env vars and bump Go image to 1.25

- bind postgres.password to POSTGRES_PASSWORD env var via viper BindEnv
  - bind service.secret_key to SERVICE_SECRET_KEY env var via viper BindEnv
  - upgrade builder base image from golang:1.24-alpine to golang:1.25-alpine

config/config.go

@@ -145,6 +145,9 @@ func ReadAndInitConfig(configDir, configName, configType string) (modelRTConfig
 		panic(err)
 	}
 
+	config.BindEnv("postgres.password", "POSTGRES_PASSWORD")
+	config.BindEnv("service.secret_key", "SERVICE_SECRET_KEY")
+
 	if err := config.Unmarshal(&modelRTConfig); err != nil {
 		panic(fmt.Sprintf("unmarshal modelRT config failed:%s\n", err.Error()))
 	}

deploy/dockerfile/modelrt.Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.24-alpine AS builder
+FROM golang:1.25-alpine AS builder
 RUN apk --no-cache upgrade
 
 WORKDIR /app