订单接口最小化与私有文件访问加固

- 订单列表使用独立最小 DTO 并分页，号主待办提供独立接口与统计
- 用户 token 增加版本控制，冻结/改密/退出即时撤销会话
- 移除 URL token 传参，SSE 与接口统一使用 HttpOnly Cookie
- 私有文件按上传归属与业务关联授权，收款凭证转私有访问并校验归属
- 公开商品接口返回最小字段，隐藏号主身份与内部状态
- 每日清理超过 30 天未关联业务的上传归属，上传归属失败时补偿删除对象

frontend/src/stores/mobileHomeCache.ts

@@ -9,7 +9,7 @@ import {
   emptyListingPublishOptions,
   type ListingPublishOptions,
 } from '@/features/listings/api/listingOptions'
-import type { Listing } from '@/features/listings/api/listings'
+import type { PublicListingItem } from '@/features/listings/api/listings'
 
 export type MobileHomeRangeFilters = Record<string, { min: string; max: string }>
 
@@ -34,7 +34,7 @@ export const useMobileHomeCacheStore = defineStore('mobileHomeCache', {
   state: () => ({
     /** 与当前 listings 数据对应的筛选签名；空字符串表示尚无可用快照 */
     listSignature: '',
-    listings: [] as Listing[],
+    listings: [] as PublicListingItem[],
     totalListings: 0,
     zoneCounts: {} as Record<string, number>,
     /** 下一页页码（与 MobileHomeView.currentPage 语义一致） */
@@ -58,7 +58,7 @@ export const useMobileHomeCacheStore = defineStore('mobileHomeCache', {
     },
     saveList(payload: {
       signature: string
-      listings: Listing[]
+      listings: PublicListingItem[]
       totalListings: number
       zoneCounts: Record<string, number>
       currentPage: number

frontend/src/stores/session.ts

@@ -1,6 +1,12 @@
 import { defineStore } from 'pinia'
 
-import { fetchMe, loginWithSms, updateMe, type AuthUser } from '@/features/auth/api/auth'
+import {
+  fetchMe,
+  loginWithSms,
+  logoutUser,
+  updateMe,
+  type AuthUser,
+} from '@/features/auth/api/auth'
 import {
   clearAuthStorage,
   getAccessToken,
@@ -83,7 +89,12 @@ export const useSessionStore = defineStore('session', {
       this.applyUser(user)
       return user
     },
-    logout() {
+    async logout() {
+      try {
+        await logoutUser()
+      } catch {
+        // 本地退出不依赖网络成功，避免用户无法离开当前账号。
+      }
       this.token = ''
       this.refreshToken = ''
       this.userId = 0