订单接口最小化与私有文件访问加固

- 订单列表使用独立最小 DTO 并分页，号主待办提供独立接口与统计
- 用户 token 增加版本控制，冻结/改密/退出即时撤销会话
- 移除 URL token 传参，SSE 与接口统一使用 HttpOnly Cookie
- 私有文件按上传归属与业务关联授权，收款凭证转私有访问并校验归属
- 公开商品接口返回最小字段，隐藏号主身份与内部状态
- 每日清理超过 30 天未关联业务的上传归属，上传归属失败时补偿删除对象

frontend/src/features/listings/views/ListingDetailView.vue

@@ -6,7 +6,7 @@ import { useRoute, useRouter } from 'vue-router'
 import { ShoppingCart, Star, StarFilled, ArrowLeft } from '@element-plus/icons-vue'
 import { goBackOrHome } from '@/shared/utils/routerBack'
 
-import { fetchListing, type Listing } from '@/features/listings/api/listings'
+import { fetchListing, type PublicListingDetail } from '@/features/listings/api/listings'
 import { useListingCollections } from '@/features/listings/composables/useListingCollections'
 import {
   createOrder,
@@ -63,7 +63,7 @@ const canCreateOrderAfterAgreement = computed(
     virtualAgreementChecked.value &&
     renterAgreementChecked.value
 )
-const listing = ref<Listing | null>(null)
+const listing = ref<PublicListingDetail | null>(null)
 
 onMounted(async () => {
   loading.value = true
@@ -135,7 +135,7 @@ const detailScreenshots = computed(() => {
 })
 const detailScreenshotUrls = computed(() => detailScreenshots.value.map(shot => shot.url))
 
-function readGroupedScreenshots(item: Listing) {
+function readGroupedScreenshots(item: PublicListingDetail) {
   const groups = item.asset_summary?.screenshot_groups
   if (typeof groups !== 'object' || groups === null) return []
   const slots = [
@@ -337,7 +337,7 @@ watch(agreementVisible, visible => {
   }
 })
 
-function listingPrice(item: Listing) {
+function listingPrice(item: PublicListingDetail) {
   return formatMoney(getListingDisplayPrice(item))
 }
 
@@ -505,9 +505,7 @@ function goBack() {
             <span class="order-eyebrow">平台担保</span>
             <h2>立即下单</h2>
           </div>
-          <span class="order-state" :class="{ 'is-busy': listing.in_transaction }">
-            {{ listing.in_transaction ? '交易中' : '可租' }}
-          </span>
+          <span class="order-state">可租</span>
         </div>
         <p class="order-safe-text">平台托管订单与押金，按平台交接流程完成账号使用。</p>
 
@@ -553,12 +551,11 @@ function goBack() {
               type="warning"
               size="large"
               :loading="ordering || agreementsLoading"
-              :disabled="listing.in_transaction"
               class="full-control order-primary-btn"
               @click="handleCreateOrder"
             >
               <el-icon><ShoppingCart /></el-icon>
-              {{ listing.in_transaction ? '交易中' : '立即下单' }}
+              立即下单
             </el-button>
             <el-button
               class="full-control favorite-order-btn"

frontend/src/features/listings/views/MobileHomeView.vue

@@ -10,7 +10,7 @@ import {
 } from '@/features/listings/api/listingOptions'
 import {
   fetchListingsPage,
-  type Listing,
+  type PublicListingItem,
   type PublicListingQuery,
 } from '@/features/listings/api/listings'
 import {
@@ -65,7 +65,7 @@ const scrollEl = ref<HTMLElement | null>(null)
 const loading = ref(false)
 const loadingMore = ref(false)
 const loadFailed = ref(false)
-const listings = ref<Listing[]>([])
+const listings = ref<PublicListingItem[]>([])
 const totalListings = ref(0)
 const zoneCounts = ref<Record<string, number>>({})
 const currentPage = ref(1)
@@ -772,7 +772,7 @@ function getAccessBadgeMeta(value: string) {
   return { icon: 'bookmark-o', tone: 'default' }
 }
 
-function getMobileRatioText(item: Listing) {
+function getMobileRatioText(item: PublicListingItem) {
   const ratio = getRatioValue(item)
   if (ratio <= 0) return ''
   const formatted = Number.isInteger(ratio) ? String(ratio) : ratio.toFixed(1)

frontend/src/features/listings/views/MobileListingDetailView.vue

@@ -4,7 +4,7 @@ import { computed, nextTick, onMounted, ref } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 import { showToast, showDialog } from 'vant'
 
-import { fetchListing, type Listing } from '@/features/listings/api/listings'
+import { fetchListing, type PublicListingDetail } from '@/features/listings/api/listings'
 import { useListingCollections } from '@/features/listings/composables/useListingCollections'
 import {
   createOrder,
@@ -43,7 +43,7 @@ const loading = ref(false)
 const ordering = ref(false)
 const agreementsLoading = ref(false)
 const agreementVisible = ref(false)
-const listing = ref<Listing | null>(null)
+const listing = ref<PublicListingDetail | null>(null)
 const agreements = ref<OrderAgreements | null>(null)
 const virtualAgreementRead = ref(false)
 const renterAgreementRead = ref(false)
@@ -135,7 +135,7 @@ const detailScreenshots = computed(() => {
 })
 const detailScreenshotUrls = computed(() => detailScreenshots.value.map(shot => shot.url))
 
-function readGroupedScreenshots(item: Listing) {
+function readGroupedScreenshots(item: PublicListingDetail) {
   const groups = item.asset_summary?.screenshot_groups
   if (typeof groups !== 'object' || groups === null) return []
   const slots = [
@@ -493,11 +493,10 @@ function handleToggleFavorite() {
           round
           class="order-btn"
           :loading="ordering || agreementsLoading"
-          :disabled="listing.in_transaction"
           loading-text="下单中..."
           @click="handleCreateOrder"
         >
-          {{ listing.in_transaction ? '交易中' : '立即下单' }}
+          立即下单
         </van-button>
       </div>