合并 main 分支并融合订单列表最小化与 SQL 治理

- Auth/权限中间件取 main 演进版（错误细分、token 来源），保留 dev 的用户 cookie 与登出撤销语义
- 后台订单列表：融合 main 的首页免 COUNT 优化与关键词索引路由，保留 dev 的最小化 AdminOrderListItemDTO（结账明细仍由详情接口返回，同步调整对应集成测试）
- 保留 dev 的 token_version 冻结/解冻递增与 main 的状态变化判断及通知
- 前端：保留 dev 登出接口与 main 的 fetchMe silent 参数、SSE 登录跳转；后台订单表按 dev 最小化 DTO 移除号主到手列

frontend/src/features/orders/api/orders.ts

@@ -46,6 +46,8 @@ export interface Order {
   growth_points_awarded?: number
   growth_points_awarded_at?: string
   account_snapshot?: Record<string, unknown>
+  account_source?: 'internal' | 'external' | string
+  source_channel?: string
   listing_snapshot?: string
   checkout_info?: string
   counter_info?: string
@@ -199,6 +201,27 @@ export interface HandoffRecord {
   created_at: string
 }
 
+export interface ProcessEvent {
+  id: number
+  business_type: string
+  business_id: number
+  stage: string
+  action: string
+  actor_type: 'user' | 'admin' | 'system' | string
+  actor_id: number
+  actor_name: string
+  target_type: string
+  target_id?: number
+  target_name: string
+  content: string
+  reason: string
+  payload: Record<string, unknown>
+  attachment_urls: string[]
+  state_before: Record<string, unknown>
+  state_after: Record<string, unknown>
+  created_at: string
+}
+
 export interface PaymentOrder {
   id: number
   payment_no: string
@@ -357,6 +380,13 @@ export async function fetchHandoffRecords(id: string | number) {
   return Array.isArray(data.data?.items) ? data.data.items : []
 }
 
+export async function fetchAdminOrderProcessEvents(id: string | number) {
+  const { data } = await apiClient.get<ApiResponse<{ items: ProcessEvent[] }>>(
+    `/admin/orders/${id}/process-events`
+  )
+  return Array.isArray(data.data?.items) ? data.data.items : []
+}
+
 export async function confirmReceive(id: number) {
   const { data } = await apiClient.post<ApiResponse<{ confirmed: boolean }>>(
     `/orders/${id}/confirm-receive`
@@ -500,10 +530,14 @@ export async function adminForceHandoff(id: number, content: string, reason: str
   return data.data
 }
 
-export async function adminPlatformCheckoutConfirm(id: number, reason: string) {
+export async function adminPlatformCheckoutConfirm(
+  id: number,
+  reason: string,
+  confirmZeroOwnerIncome = false
+) {
   const { data } = await apiClient.post<ApiResponse<{ confirmed: boolean }>>(
     `/admin/orders/${id}/platform-checkout/confirm`,
-    { reason }
+    { reason, confirm_zero_owner_income: confirmZeroOwnerIncome }
   )
   return data.data
 }
@@ -581,3 +615,11 @@ export async function fetchPendingRefundOrders() {
   )
   return data.data.items
 }
+
+export async function fetchPendingRefundCount() {
+  const { data } = await apiClient.get<ApiResponse<{ pending_refund_count: number }>>(
+    '/admin/orders/refund-pending-count',
+    { silent: true }
+  )
+  return data.data.pending_refund_count
+}