📝 docs(agora-stt): update component documentation and security configuration

- adjust component and test file paths to admin directory: src/client/admin/components/agora-stt/
- modify AGORA_CONFIG to use environment variables for sensitive information
- add security considerations section covering authentication, data protection and compliance requirements
- update file list to reflect new admin directory structure

docs/stories/005.001.story.md

@@ -53,22 +53,23 @@ High - 新功能实现，增强用户体验
 - **测试框架**: Vitest + Testing Library
 
 ### 项目结构指导 [Source: architecture/source-tree.md]
-- **组件位置**: `src/client/components/agora-stt/`
-- **测试位置**: `src/client/components/agora-stt/__tests__/`
+- **组件位置**: `src/client/admin/components/agora-stt/` (管理后台专用组件 - 基于架构文档分析)
+- **测试位置**: `src/client/admin/components/agora-stt/__tests__/`
 - **类型定义**: `src/client/types/agora-stt.ts`
 - **工具函数**: `src/client/utils/agora-stt.ts`
 
 ### Agora配置参数 [Source: docs/agora实时语音转录翻译参考文档.md]
 ```typescript
+// 使用环境变量安全配置（生产环境必须设置）
 const AGORA_CONFIG = {
-  appId: 'f6ef0878d92340f88cff5c3e3d73bad2',
-  primaryCert: 'd16304cc8bb34bccbae589835141926f',
-  token: '007eJxTYKiOPOI+4+KN+V72elnHrV+a3WC++OCfrvXy1+x/6w7tPuypwGCWZm5ulmRmmWacZm6SbGZkkWJumJacaG5gYmGempiU6mp+NqMhkJHhtWEyAyMUgvjMDIZGxgwMAL7vIE0=',
-  channel: '123',
-  key: 'e40d60014fb7457aa6052c964a746adf',
-  secret: '8efd206266f541488725499165b78983',
-  sttJoinUrl: 'https://api.agora.io/v7/rtm/stt/join',
-  sttWsUrl: 'wss://api.agora.io/v7/rtm/stt/connect'
+  appId: process.env.AGORA_APP_ID,
+  primaryCert: process.env.AGORA_PRIMARY_CERT,
+  token: process.env.AGORA_TOKEN,
+  channel: process.env.AGORA_CHANNEL || '123',
+  key: process.env.AGORA_KEY,
+  secret: process.env.AGORA_SECRET,
+  sttJoinUrl: process.env.AGORA_STT_JOIN_URL || 'https://api.agora.io/v7/rtm/stt/join',
+  sttWsUrl: process.env.AGORA_STT_WS_URL || 'wss://api.agora.io/v7/rtm/stt/connect'
 };
 ```
 
@@ -92,6 +93,22 @@ const AGORA_CONFIG = {
 - **状态管理**: 与现有React状态管理集成
 - **错误处理**: 统一错误处理机制
 
+### 安全考虑
+#### 认证与授权
+- 使用环境变量存储敏感配置信息
+- 实现适当的令牌刷新机制
+- 通过认证保护WebSocket连接安全
+
+#### 数据保护
+- 确保用户对麦克风使用的明确同意
+- 实施适当的错误处理，避免敏感数据泄露
+- 遵循语音数据处理的隐私法规
+
+#### 合规要求
+- GDPR合规的语音数据处理
+- 麦克风访问的用户同意机制
+- 数据保留和删除策略
+
 ## Testing
 
 ### 测试策略 [Source: docs/architecture/testing-strategy.md]
@@ -120,6 +137,9 @@ const AGORA_CONFIG = {
 | Date | Version | Description | Author |
 |------|---------|-------------|--------|
 | 2025-09-23 | 1.0 | 初始故事创建 | John (PM) |
+| 2025-09-23 | 1.1 | 安全配置修复：环境变量替代硬编码 | Bob (SM) |
+| 2025-09-23 | 1.1 | 目录结构对齐：组件位置修正 | Bob (SM) |
+| 2025-09-23 | 1.1 | 添加安全考虑章节 | Bob (SM) |
 
 ## Dev Agent Record
 
@@ -130,12 +150,12 @@ const AGORA_CONFIG = {
 ### Completion Notes List
 
 ### File List
-- `src/client/components/agora-stt/AgoraSTTComponent.tsx` - 主组件文件
-- `src/client/components/agora-stt/__tests__/AgoraSTTComponent.test.tsx` - 组件测试
+- `src/client/admin/components/agora-stt/AgoraSTTComponent.tsx` - 主组件文件
+- `src/client/admin/components/agora-stt/__tests__/AgoraSTTComponent.test.tsx` - 组件测试
 - `src/client/types/agora-stt.ts` - 类型定义
 - `src/client/utils/agora-stt.ts` - 工具函数
 - `src/client/hooks/useAgoraSTT.ts` - 自定义Hook
-- `src/client/components/agora-stt/index.ts` - 组件导出文件
+- `src/client/admin/components/agora-stt/index.ts` - 组件导出文件
 
 ## QA Results