perf(query): 全面治理后台跨表模糊查询慢SQL并升级SQL门禁守护

- 解决 MySQL 8.4 无法跨表 Index Merge 导致的索引失效与全表扫描问题
- 订单/提号/纠纷/用户/商品/会话列表实现智能意图路由分流直达单表唯一索引
- 剥离 COUNT(*) 阶段无关多表关联及标量子查询，实现首页条数快速短路
- check-sql-guard.sh 增加 forbid_pattern 拦截器与核心路由强校验防线

backend/internal/modules/listing/query.go

@@ -66,12 +66,6 @@ func (r *Repository) ListAdmin(ctx context.Context, query AdminListQuery) (*Admi
 		}, nil
 	}
 
-	countDB := r.applyAdminListFilters(r.db.WithContext(ctx).Table("rental_listings AS l"), query)
-	var total int64
-	if err := countDB.Count(&total).Error; err != nil {
-		return nil, err
-	}
-
 	db := r.applyAdminListFilters(r.baseQuery(ctx), query)
 	offset := (page - 1) * pageSize
 	if offset < 0 {
@@ -82,6 +76,17 @@ func (r *Repository) ListAdmin(ctx context.Context, query AdminListQuery) (*Admi
 	if err != nil {
 		return nil, err
 	}
+
+	var total int64
+	// 首页查询且返回条数小于 pageSize 时，总数等于当前返回条数，彻底免除第二次 COUNT(*) 扫描
+	if page == 1 && len(rows) < pageSize {
+		total = int64(len(rows))
+	} else {
+		countDB := r.applyAdminListFilters(r.db.WithContext(ctx).Table("rental_listings AS l"), query)
+		if err := countDB.Count(&total).Error; err != nil {
+			return nil, err
+		}
+	}
 	return &AdminListResult{
 		Items:    rowsToDTO(rows),
 		Total:    total,
@@ -95,8 +100,14 @@ func (r *Repository) applyAdminListFilters(db *gorm.DB, query AdminListQuery) *g
 		db = db.Where("l.owner_id = ?", query.OwnerID)
 	}
 	if keyword := strings.TrimSpace(query.Keyword); keyword != "" {
-		like := "%" + keyword + "%"
-		if id, err := strconv.ParseUint(keyword, 10, 64); err == nil {
+		upper := strings.ToUpper(keyword)
+		if strings.HasPrefix(upper, "RO") || strings.HasPrefix(upper, "ORD") {
+			// 订单号：命中 rental_orders(order_no) 唯一索引
+			db = db.Where("EXISTS (SELECT 1 FROM rental_orders AS o WHERE o.listing_id = l.id AND o.order_no = ?)", keyword)
+		} else if strings.HasPrefix(upper, "L") {
+			// 商品编号：命中 rental_listings(listing_no) 唯一索引
+			db = db.Where("l.listing_no = ?", keyword)
+		} else if id, err := strconv.ParseUint(keyword, 10, 64); err == nil && id > 0 && keyword[0] != '0' && id < 100000000 {
 			db = db.Where(
 				`(l.listing_no = ? OR EXISTS (SELECT 1 FROM rental_orders AS o WHERE o.listing_id = l.id AND o.order_no = ?) OR l.id = ? OR l.account_id = ? OR l.owner_id = ?)`,
 				keyword,
@@ -106,6 +117,7 @@ func (r *Repository) applyAdminListFilters(db *gorm.DB, query AdminListQuery) *g
 				id,
 			)
 		} else {
+			like := "%" + keyword + "%"
 			db = db.Where(
 				`(l.listing_no LIKE ? OR EXISTS (SELECT 1 FROM rental_orders AS o WHERE o.listing_id = l.id AND o.order_no LIKE ?))`,
 				like,