订单接口最小化与私有文件访问加固

- 订单列表使用独立最小 DTO 并分页，号主待办提供独立接口与统计
- 用户 token 增加版本控制，冻结/改密/退出即时撤销会话
- 移除 URL token 传参，SSE 与接口统一使用 HttpOnly Cookie
- 私有文件按上传归属与业务关联授权，收款凭证转私有访问并校验归属
- 公开商品接口返回最小字段，隐藏号主身份与内部状态
- 每日清理超过 30 天未关联业务的上传归属，上传归属失败时补偿删除对象

frontend/src/features/admin/views/AdminOrdersView.vue

@@ -3,7 +3,7 @@ import { ArrowLeft, Refresh, Search } from '@element-plus/icons-vue'
 import { computed, onMounted, reactive, ref } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 
-import { fetchAdminOrders, type AdminOrderQuery, type Order } from '@/features/orders'
+import { fetchAdminOrders, type AdminOrderListItem, type AdminOrderQuery } from '@/features/orders'
 import {
   orderHandoffStatusLabel,
   orderStatusLabel,
@@ -24,7 +24,7 @@ const filters = reactive<AdminOrderQuery>({
   offline_settlement_status: '',
 })
 const loading = ref(false)
-const orders = ref<Order[]>([])
+const orders = ref<AdminOrderListItem[]>([])
 const total = ref(0)
 const currentPage = ref(1)
 const currentPageSize = ref(20)
@@ -153,7 +153,7 @@ function userText(value: string | number | undefined) {
   return value || '-'
 }
 
-function isPlatformManaged(row: Order) {
+function isPlatformManaged(row: AdminOrderListItem) {
   return row.handoff_mode === 'platform' || row.settlement_mode === 'platform_managed'
 }
 </script>
@@ -298,9 +298,9 @@ function isPlatformManaged(row: Order) {
       <el-table-column label="用户" min-width="170">
         <template #default="{ row }">
           <div class="stacked-cell compact">
-            <span>租客 {{ userText(row.renter_phone || row.renter_id) }}</span>
+            <span>租客 {{ userText(row.renter_phone) }}</span>
             <span v-if="isPlatformManaged(row)" class="platform-managed-owner">号主 平台代管</span>
-            <span v-else>号主 {{ userText(row.owner_phone || row.owner_id) }}</span>
+            <span v-else>号主 {{ userText(row.owner_phone) }}</span>
           </div>
         </template>
       </el-table-column>