fix(distribution): 修正分销后台入口地址并收口主站后台隐藏路径

- 新增前端 distributionAdmin 工具：优先 VITE_DISTRIBUTION_ADMIN_URL，
  本地开发回退 5190，生产按 distribution.<主站域名> 推导
- 替换主站后台「打开独立分销后台」按钮与开通凭证中硬编码的 :5190
- 分销后台复制凭证改用 window.location.origin，去掉硬编码 http
- Caddyfile 中 /manage-7x9k2p 仅主站域名放行，分站域名统一 404
- 构建/部署链路透传 VITE_DISTRIBUTION_ADMIN_URL 与 ADMIN_BASE_PATH

frontend/src/shared/utils/__tests__/distributionAdmin.spec.ts

@@ -0,0 +1,49 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import { distributionAdminBaseUrl, distributionAdminLoginUrl } from '../distributionAdmin'
+
+function stubLocation(hostname: string, protocol = 'https:') {
+  Object.defineProperty(window, 'location', {
+    configurable: true,
+    writable: true,
+    value: { hostname, protocol } as Location,
+  })
+}
+
+describe('distributionAdmin 分销后台地址', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it('优先使用 VITE_DISTRIBUTION_ADMIN_URL 并去掉结尾斜杠', () => {
+    vi.stubEnv('VITE_DISTRIBUTION_ADMIN_URL', ' https://dist.example.com/ ')
+    stubLocation('hao858.com')
+    expect(distributionAdminBaseUrl()).toBe('https://dist.example.com')
+    expect(distributionAdminLoginUrl()).toBe('https://dist.example.com/login')
+  })
+
+  it('本地开发回退到 5190 独立端口', () => {
+    vi.stubEnv('VITE_DISTRIBUTION_ADMIN_URL', '')
+    stubLocation('localhost', 'http:')
+    expect(distributionAdminBaseUrl()).toBe('http://localhost:5190')
+    expect(distributionAdminLoginUrl()).toBe('http://localhost:5190/login')
+  })
+
+  it('生产按主站域名推导 distribution 子域', () => {
+    vi.stubEnv('VITE_DISTRIBUTION_ADMIN_URL', '')
+    stubLocation('hao858.com')
+    expect(distributionAdminBaseUrl()).toBe('https://distribution.hao858.com')
+  })
+
+  it('h5 过渡域名会去掉前缀后再推导', () => {
+    vi.stubEnv('VITE_DISTRIBUTION_ADMIN_URL', '')
+    stubLocation('h5.hao858.com')
+    expect(distributionAdminBaseUrl()).toBe('https://distribution.hao858.com')
+  })
+
+  it('多级域名与 Caddyfile 的 distribution.<CADDY_DOMAIN> 保持一致', () => {
+    vi.stubEnv('VITE_DISTRIBUTION_ADMIN_URL', '')
+    stubLocation('hfb.221329.cc.cd')
+    expect(distributionAdminBaseUrl()).toBe('https://distribution.hfb.221329.cc.cd')
+  })
+})

frontend/src/shared/utils/distributionAdmin.ts

@@ -0,0 +1,35 @@
+/**
+ * 分销（分站）管理后台入口地址。
+ *
+ * 解析优先级：
+ * 1. 构建期注入的 VITE_DISTRIBUTION_ADMIN_URL
+ *    （deploy/docker-compose.prod.yml 会把它透传给 Caddy 镜像构建，推荐生产显式配置）；
+ * 2. 本地开发保留独立端口（与 scripts/dev.sh 的 DEV_DISTRIBUTION_PORT 默认值一致）；
+ * 3. 其余情况按 deploy/caddy/Caddyfile 的 `distribution.{$CADDY_DOMAIN}` 规则从当前主站域名推导，
+ *    主站可能同时挂 h5.{$CADDY_DOMAIN} 过渡域名，推导时先去掉 h5. 前缀。
+ */
+const DEV_DISTRIBUTION_ADMIN_PORT = 5190
+
+function isLocalHostname(hostname: string): boolean {
+  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname.endsWith('.localhost')
+}
+
+export function distributionAdminBaseUrl(): string {
+  const configured = (import.meta.env.VITE_DISTRIBUTION_ADMIN_URL as string | undefined)?.trim()
+  if (configured) return configured.replace(/\/+$/, '')
+
+  if (typeof window === 'undefined') return ''
+
+  const { hostname, protocol } = window.location
+  if (isLocalHostname(hostname)) {
+    return `http://${hostname}:${DEV_DISTRIBUTION_ADMIN_PORT}`
+  }
+
+  const rootHostname = hostname.startsWith('h5.') ? hostname.slice('h5.'.length) : hostname
+  return `${protocol}//distribution.${rootHostname}`
+}
+
+export function distributionAdminLoginUrl(): string {
+  const base = distributionAdminBaseUrl()
+  return base ? `${base}/login` : ''
+}