Distributed photovoltaic (PV) power stations are core enablers for dual-carbon goals in modern power systems, with IoT-based monitoring systems serving as their nerve center for real-time data collection and grid dispatch. However, PV monitoring nodes operate in harsh, unattended outdoor environments with severe computational resource constraints, exposing them to critical hardware security risks that can trigger cross-domain cascading hazards. Existing research focuses primarily on communication and software security, lacking systematic hardware security modeling and lightweight defense designs. Generic IoT hardware security solutions are also inapplicable due to excessive overhead. To address these gaps, this paper proposes LHSF, a lightweight hardware security framework tailored for resource-constrained PV edge nodes. It integrates an on-chip OTP-based lightweight hardware root of trust (L-HROT) with an SRAM-PUF-driven non-resident key management protocol, which implements full-lifecycle key management via a “power-on generation, on-demand usage, post-use destruction, zero-residue storage” paradigm. Experiments on ESP32 and Raspberry Pi 4B show that LHSF provides robust resistance to side-channel recovery, physical extraction, malicious firmware boot and rollback attacks, reducing fault injection bypass rate to 6.8%. Compared to standard TPM 2.0, it cuts boot delay by 60.7%, power consumption by 18.6% and memory footprint by 72.7% with negligible performance overhead. This work fills the hardware security gap for PV monitoring systems and provides a reusable technical pathway for distributed energy IoT terminals.