fix(stability): 修复慢查询雪崩隐患、系统配置死锁与提号翻页错误

- 消除 system_configs 写锁争抢：使用读写锁与启动预热将默认配置初始化收敛为单例，杜绝读请求开事务导致的 Lock wait timeout exceeded
- 强化财务看板缓存：将 Redis 缓存有效期由 1 分钟延长为 5 分钟，接入 singleflight.Group 防并发击穿
- 修复提号列表 GORM 翻页 Bug：分离 Count 查询与列表查询构建，避免重复 Join 导致的 Error 1066
- 生产环境资源加固：docker-compose.prod.yml 中 MySQL 资源限制提升至 2.0 核 CPU、2G 内存
- 补充 systemconfig 并发测试与 pickup 分页 Count 回归测试

backend/internal/modules/adminfinance/dashboard.go

@@ -2,6 +2,7 @@ package adminfinance
 
 import (
 	"context"
+	"errors"
 	"sync"
 
 	"hfb_sys/backend/internal/timeutil"
@@ -11,6 +12,26 @@ func (r *Repository) Dashboard(ctx context.Context, query DashboardQuery) (*Dash
 	if cached := r.loadDashboardCache(ctx, query); cached != nil {
 		return cached, nil
 	}
+
+	key := r.dashboardCacheKey(query)
+	val, err, _ := r.sfGroup.Do(key, func() (any, error) {
+		// 在 singleflight 内部二次检查缓存，避免排队等待的并发请求重复执行大聚合
+		if cached := r.loadDashboardCache(ctx, query); cached != nil {
+			return cached, nil
+		}
+		return r.calculateDashboard(ctx, query)
+	})
+	if err != nil {
+		return nil, err
+	}
+	res, ok := val.(*DashboardDTO)
+	if !ok {
+		return nil, errors.New("invalid dashboard result type")
+	}
+	return res, nil
+}
+
+func (r *Repository) calculateDashboard(ctx context.Context, query DashboardQuery) (*DashboardDTO, error) {
 	// 各板块的读取互不依赖。并行执行能避免单个请求串行等待二十余条统计 SQL，
 	// 首次打开或缓存失效时仍可尽快返回；每个查询继续复用 GORM 的连接池。
 	var (

backend/internal/modules/adminfinance/dashboard_cache.go

@@ -7,7 +7,7 @@ import (
 	"time"
 )
 
-const dashboardCacheTTL = time.Minute
+const dashboardCacheTTL = 5 * time.Minute
 
 func (r *Repository) dashboardCacheKey(query DashboardQuery) string {
 	return fmt.Sprintf("admin-finance:dashboard:v1:%d:%d", query.StartDate.Unix(), query.EndDate.Unix())

backend/internal/modules/adminfinance/dashboard_test.go

@@ -1,6 +1,8 @@
 package adminfinance
 
 import (
+	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -369,3 +371,33 @@ func TestSummaryFromDailyRowsPreservesDashboardTotals(t *testing.T) {
 		t.Fatalf("订单状态汇总错误: %+v", summary)
 	}
 }
+
+func TestDashboardCacheKeyAndSingleflight(t *testing.T) {
+	repo := NewRepository(nil)
+	q := DashboardQuery{
+		StartDate: time.Date(2026, 9, 1, 0, 0, 0, 0, time.UTC),
+		EndDate:   time.Date(2026, 9, 7, 0, 0, 0, 0, time.UTC),
+	}
+	key := repo.dashboardCacheKey(q)
+	if key == "" {
+		t.Fatal("cache key should not be empty")
+	}
+
+	var callCount atomic.Int32
+	var wg sync.WaitGroup
+	for i := 0; i < 10; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_, _, _ = repo.sfGroup.Do(key, func() (any, error) {
+				callCount.Add(1)
+				time.Sleep(20 * time.Millisecond)
+				return &DashboardDTO{}, nil
+			})
+		}()
+	}
+	wg.Wait()
+	if count := callCount.Load(); count != 1 {
+		t.Fatalf("singleflight 并发合并失败: got %d, want 1", count)
+	}
+}

backend/internal/modules/adminfinance/repository.go

@@ -2,12 +2,14 @@ package adminfinance
 
 import (
 	"github.com/redis/go-redis/v9"
+	"golang.org/x/sync/singleflight"
 	"gorm.io/gorm"
 )
 
 type Repository struct {
-	db    *gorm.DB
-	redis *redis.Client
+	db      *gorm.DB
+	redis   *redis.Client
+	sfGroup singleflight.Group
 }
 
 func NewRepository(db *gorm.DB, redisClient ...*redis.Client) *Repository {

backend/internal/modules/pickup/repository.go

@@ -893,44 +893,46 @@ func (r *Repository) ListAvailableListings(ctx context.Context, query AvailableL
 		Select("listing_id, MAX(id) AS upload_id").
 		Where("listing_id IS NOT NULL").
 		Group("listing_id")
-	db := r.db.WithContext(ctx).Table("rental_listings AS l").
-		Select(`l.id, l.listing_no, l.account_id, l.owner_id, l.price_cent AS listing_price_cent,
-			a.title AS account_title, a.server_region, a.login_platform, a.haf_coin_amount, a.asset_summary,
-			owner.phone AS owner_phone, l.handoff_mode, l.settlement_mode,
-			CASE WHEN lu.id IS NULL THEN 0 ELSE 1 END AS is_external_upload,
-			COALESCE(lu.source_channel, '') AS source_channel`).
-		Joins("JOIN game_accounts AS a ON a.id = l.account_id").
-		Joins("JOIN users AS owner ON owner.id = l.owner_id").
-		Joins("LEFT JOIN (?) AS latest_upload ON latest_upload.listing_id = l.id", latestUploads).
-		Joins("LEFT JOIN listing_uploads AS lu ON lu.id = latest_upload.upload_id").
-		Where("l.status = ? AND l.review_status = ? AND l.in_transaction = ?", "published", "approved", false)
-	if kw := strings.TrimSpace(query.Keyword); kw != "" {
-		upper := strings.ToUpper(kw)
-		if strings.HasPrefix(upper, "L") || (len(kw) >= 12 && isAllDigits(kw)) {
-			db = db.Where("l.listing_no = ?", kw)
-		} else {
-			like := "%" + kw + "%"
-			db = db.Where("l.listing_no LIKE ? OR a.title LIKE ?", like, like)
+	buildQuery := func() *gorm.DB {
+		q := r.db.WithContext(ctx).Table("rental_listings AS l").
+			Joins("JOIN game_accounts AS a ON a.id = l.account_id").
+			Joins("JOIN users AS owner ON owner.id = l.owner_id").
+			Joins("LEFT JOIN (?) AS latest_upload ON latest_upload.listing_id = l.id", latestUploads).
+			Joins("LEFT JOIN listing_uploads AS lu ON lu.id = latest_upload.upload_id").
+			Where("l.status = ? AND l.review_status = ? AND l.in_transaction = ?", "published", "approved", false)
+		if kw := strings.TrimSpace(query.Keyword); kw != "" {
+			upper := strings.ToUpper(kw)
+			if strings.HasPrefix(upper, "L") || (len(kw) >= 12 && isAllDigits(kw)) {
+				q = q.Where("l.listing_no = ?", kw)
+			} else {
+				like := "%" + kw + "%"
+				q = q.Where("l.listing_no LIKE ? OR a.title LIKE ?", like, like)
+			}
 		}
-	}
-	switch strings.TrimSpace(query.SourceType) {
-	case ListingSourceExternal:
-		db = db.Where("lu.id IS NOT NULL")
-	case ListingSourceInternal:
-		db = db.Where("lu.id IS NULL")
+		switch strings.TrimSpace(query.SourceType) {
+		case ListingSourceExternal:
+			q = q.Where("lu.id IS NOT NULL")
+		case ListingSourceInternal:
+			q = q.Where("lu.id IS NULL")
+		}
+		return q
 	}
 
 	page, pageSize := normalizePaging(query.Page, query.PageSize)
 	var rows []availableListingRow
-	if err := db.Order("l.id DESC").Offset((page - 1) * pageSize).Limit(pageSize).Scan(&rows).Error; err != nil {
+	if err := buildQuery().Select(`l.id, l.listing_no, l.account_id, l.owner_id, l.price_cent AS listing_price_cent,
+			a.title AS account_title, a.server_region, a.login_platform, a.haf_coin_amount, a.asset_summary,
+			owner.phone AS owner_phone, l.handoff_mode, l.settlement_mode,
+			CASE WHEN lu.id IS NULL THEN 0 ELSE 1 END AS is_external_upload,
+			COALESCE(lu.source_channel, '') AS source_channel`).
+		Order("l.id DESC").Offset((page - 1) * pageSize).Limit(pageSize).Scan(&rows).Error; err != nil {
 		return nil, err
 	}
 	var total int64
 	if page == 1 && len(rows) < pageSize {
 		total = int64(len(rows))
 	} else {
-		countDB := db.Session(&gorm.Session{}).Select("l.id")
-		if err := countDB.Count(&total).Error; err != nil {
+		if err := buildQuery().Count(&total).Error; err != nil {
 			return nil, err
 		}
 	}

backend/internal/modules/pickup/repository_test.go

@@ -283,6 +283,19 @@ func TestRepositoryListAvailableListingsFiltersAccountSource(t *testing.T) {
 	if internalResult.Total != 1 || len(internalResult.Items) != 1 {
 		t.Fatalf("站内上传结果 = total %d, items %d, want 1", internalResult.Total, len(internalResult.Items))
 	}
+
+	// 验证分页场景（len(rows) == pageSize 或 page > 1）：触发独立 Count 查询，确保不会重复 Join 报错 Error 1066
+	pagedResult, err := repo.ListAvailableListings(t.Context(), AvailableListingQuery{
+		Page:     1,
+		PageSize: 1,
+	})
+	if err != nil {
+		t.Fatalf("分页查询触发 Count 失败: %v", err)
+	}
+	if pagedResult.Total != 2 || len(pagedResult.Items) != 1 {
+		t.Fatalf("分页结果 = total %d, items %d, want total 2, items 1", pagedResult.Total, len(pagedResult.Items))
+	}
+
 	internalItem := internalResult.Items[0]
 	if internalItem.ID != internal.ID || internalItem.IsExternalUpload || internalItem.AccountSource != AccountSourceInternal {
 		t.Fatalf("站内上传账号 = id %d, external %t, source %q", internalItem.ID, internalItem.IsExternalUpload, internalItem.AccountSource)

backend/internal/modules/systemconfig/repository.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"strings"
+	"sync"
 
 	"hfb_sys/backend/internal/auditlog"
 	"hfb_sys/backend/internal/model"
@@ -15,7 +16,9 @@ import (
 )
 
 type Repository struct {
-	db *gorm.DB
+	db          *gorm.DB
+	initMu      sync.RWMutex
+	initialized bool
 }
 
 type AuditMeta = auditlog.Meta
@@ -88,8 +91,30 @@ func NewRepository(db *gorm.DB) *Repository {
 	return &Repository{db: db}
 }
 
-func (r *Repository) List(ctx context.Context) ([]ConfigDTO, error) {
+// EnsureDefaults 仅在服务启动或首次访问时初始化默认系统配置。
+// 使用读写锁保证进程生命周期内只真正落库初始化一次，避免每个读请求重复开事务写锁争抢。
+func (r *Repository) EnsureDefaults(ctx context.Context) error {
+	r.initMu.RLock()
+	if r.initialized {
+		r.initMu.RUnlock()
+		return nil
+	}
+	r.initMu.RUnlock()
+
+	r.initMu.Lock()
+	defer r.initMu.Unlock()
+	if r.initialized {
+		return nil
+	}
 	if err := r.ensureDefaults(ctx); err != nil {
+		return err
+	}
+	r.initialized = true
+	return nil
+}
+
+func (r *Repository) List(ctx context.Context) ([]ConfigDTO, error) {
+	if err := r.EnsureDefaults(ctx); err != nil {
 		return nil, err
 	}
 	var rows []model.SystemConfig
@@ -104,7 +129,7 @@ func (r *Repository) List(ctx context.Context) ([]ConfigDTO, error) {
 }
 
 func (r *Repository) FindValue(ctx context.Context, key string) (string, error) {
-	if err := r.ensureDefaults(ctx); err != nil {
+	if err := r.EnsureDefaults(ctx); err != nil {
 		return "", err
 	}
 	var row model.SystemConfig

backend/internal/modules/systemconfig/repository_test.go

@@ -0,0 +1,72 @@
+package systemconfig
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+
+	"hfb_sys/backend/internal/model"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+)
+
+func newTestSystemConfigRepo(t *testing.T) (*Repository, *gorm.DB) {
+	t.Helper()
+	dsn := fmt.Sprintf("file:%s?mode=memory&cache=shared", t.Name())
+	db, err := gorm.Open(sqlite.Open(dsn), &gorm.Config{
+		Logger: logger.Default.LogMode(logger.Silent),
+	})
+	if err != nil {
+		t.Fatalf("连接测试数据库失败: %v", err)
+	}
+	if err := db.AutoMigrate(&model.SystemConfig{}); err != nil {
+		t.Fatalf("自动迁移 SystemConfig 失败: %v", err)
+	}
+	return NewRepository(db), db
+}
+
+func TestRepositoryEnsureDefaultsConcurrency(t *testing.T) {
+	repo, _ := newTestSystemConfigRepo(t)
+	ctx := context.Background()
+
+	// 并发 20 个 goroutine 调用 EnsureDefaults
+	var wg sync.WaitGroup
+	errCh := make(chan error, 20)
+	for i := 0; i < 20; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			if err := repo.EnsureDefaults(ctx); err != nil {
+				errCh <- err
+			}
+		}()
+	}
+	wg.Wait()
+	close(errCh)
+
+	for err := range errCh {
+		if err != nil {
+			t.Fatalf("并发 EnsureDefaults 失败: %v", err)
+		}
+	}
+
+	// 再次并发调用 FindValue，验证 initialized 为 true 时直接走只读路径
+	for i := 0; i < 20; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			val, err := repo.FindValue(ctx, "handoff.owner_submit_timeout_minutes")
+			if err != nil {
+				errCh <- err
+				return
+			}
+			if val != "30" {
+				errCh <- fmt.Errorf("got %s, want 30", val)
+			}
+		}()
+	}
+	wg.Wait()
+}