Merge branch 'main' into feature/distribution-system

合入 main 的推广追踪（adtracking）模块，并解决与分销业务的 8 处冲突。

冲突解决原则：两边的字段、菜单与路由全部保留，不删任何一方。

后端：
- model/order.go：保留分销字段注释块，追加 SourceTrackCode
- model/user.go：追加 RegisterTrackCode；TokenVersion 默认值保持 1
  （与本库 users.token_version 列默认值一致）
- auth/repository.go：两处建号结构体同时写入 RegisterTrackCode 与 TokenVersion
- order/dto.go：OrderDTO 同时暴露 distribution_site_id 与 source_track_code；
  CreateRequest 同时接受 distribution_site_code 与 track_code
- order/presenter.go：同时映射 DistributionSiteID 与 SourceTrackCode

前端：
- orders/api/orders.ts：createOrder 同时携带 distribution_site_code 与 track_code
- layouts/AdminLayout.vue：分销管理菜单组与推广追踪菜单组并列保留
- router/adminRoutes.ts：分销 4 条路由与 tracking-links 路由并列保留

迁移：feature 侧 000064-000067 已在前一提交顺延为 000065-000068，
为 main 的 000064_ad_tracking 让号，合并后编号 000063→000068 连续无重复。

frontend/src/features/auth/api/auth.ts

@@ -1,6 +1,7 @@
 import { apiClient } from '@/shared/api/client'
 import type { ApiResponse } from '@/shared/types/types'
 import type { RealnameStatusValue, RiskStatus, UserStatus } from '@/shared/types/status'
+import { getTrackCode } from '@/shared/utils/trackCode'
 
 export interface AuthUser {
   id: number
@@ -51,7 +52,12 @@ export async function sendSmsCode(phone: string, captchaId: string, captchaCode:
 }
 
 export async function loginWithSms(phone: string, code: string) {
-  const { data } = await apiClient.post<ApiResponse<LoginData>>('/auth/sms/login', { phone, code })
+  const trackCode = getTrackCode()
+  const payload: Record<string, unknown> = { phone, code }
+  if (trackCode) {
+    payload.track_code = trackCode
+  }
+  const { data } = await apiClient.post<ApiResponse<LoginData>>('/auth/sms/login', payload)
   return data.data
 }
 
@@ -64,11 +70,12 @@ export async function loginWithPassword(phone: string, password: string) {
 }
 
 export async function registerWithPassword(phone: string, code: string, password: string) {
-  const { data } = await apiClient.post<ApiResponse<LoginData>>('/auth/password/register', {
-    phone,
-    code,
-    password,
-  })
+  const trackCode = getTrackCode()
+  const payload: Record<string, unknown> = { phone, code, password }
+  if (trackCode) {
+    payload.track_code = trackCode
+  }
+  const { data } = await apiClient.post<ApiResponse<LoginData>>('/auth/password/register', payload)
   return data.data
 }