订单接口最小化与私有文件访问加固

- 订单列表使用独立最小 DTO 并分页，号主待办提供独立接口与统计
- 用户 token 增加版本控制，冻结/改密/退出即时撤销会话
- 移除 URL token 传参，SSE 与接口统一使用 HttpOnly Cookie
- 私有文件按上传归属与业务关联授权，收款凭证转私有访问并校验归属
- 公开商品接口返回最小字段，隐藏号主身份与内部状态
- 每日清理超过 30 天未关联业务的上传归属，上传归属失败时补偿删除对象

frontend/src/features/listings/views/MobileListingDetailView.vue

@@ -4,7 +4,7 @@ import { computed, nextTick, onMounted, ref } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 import { showToast, showDialog } from 'vant'
 
-import { fetchListing, type Listing } from '@/features/listings/api/listings'
+import { fetchListing, type PublicListingDetail } from '@/features/listings/api/listings'
 import { useListingCollections } from '@/features/listings/composables/useListingCollections'
 import {
   createOrder,
@@ -43,7 +43,7 @@ const loading = ref(false)
 const ordering = ref(false)
 const agreementsLoading = ref(false)
 const agreementVisible = ref(false)
-const listing = ref<Listing | null>(null)
+const listing = ref<PublicListingDetail | null>(null)
 const agreements = ref<OrderAgreements | null>(null)
 const virtualAgreementRead = ref(false)
 const renterAgreementRead = ref(false)
@@ -135,7 +135,7 @@ const detailScreenshots = computed(() => {
 })
 const detailScreenshotUrls = computed(() => detailScreenshots.value.map(shot => shot.url))
 
-function readGroupedScreenshots(item: Listing) {
+function readGroupedScreenshots(item: PublicListingDetail) {
   const groups = item.asset_summary?.screenshot_groups
   if (typeof groups !== 'object' || groups === null) return []
   const slots = [
@@ -493,11 +493,10 @@ function handleToggleFavorite() {
           round
           class="order-btn"
           :loading="ordering || agreementsLoading"
-          :disabled="listing.in_transaction"
           loading-text="下单中..."
           @click="handleCreateOrder"
         >
-          {{ listing.in_transaction ? '交易中' : '立即下单' }}
+          立即下单
         </van-button>
       </div>