perf(query): 全面治理后台跨表模糊查询慢SQL并升级SQL门禁守护

- 解决 MySQL 8.4 无法跨表 Index Merge 导致的索引失效与全表扫描问题
- 订单/提号/纠纷/用户/商品/会话列表实现智能意图路由分流直达单表唯一索引
- 剥离 COUNT(*) 阶段无关多表关联及标量子查询，实现首页条数快速短路
- check-sql-guard.sh 增加 forbid_pattern 拦截器与核心路由强校验防线

backend/internal/modules/order/repository_test.go

@@ -1,6 +1,7 @@
 package order
 
 import (
+	"strings"
 	"testing"
 	"time"
 
@@ -9,6 +10,8 @@ import (
 	"hfb_sys/backend/internal/timeutil"
 
 	"gorm.io/datatypes"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
 )
 
 func pureCoinDiscountOrder() model.RentalOrder {
@@ -470,3 +473,58 @@ func TestNewOrderNoUsesShanghaiTimeWhenLocalIsUTC(t *testing.T) {
 		t.Fatalf("order no time = %s, want between %s and %s", parsed, before, after)
 	}
 }
+
+func TestApplyAdminOrderFiltersSmartRouting(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{DryRun: true})
+	if err != nil {
+		t.Fatalf("打开测试数据库失败: %v", err)
+	}
+
+	tests := []struct {
+		name        string
+		query       AdminOrderQuery
+		wantSQLFrag string
+	}{
+		{
+			name:        "11位手机号路由至users(phone)",
+			query:       AdminOrderQuery{Keyword: "13800138000"},
+			wantSQLFrag: "owner.phone = ? OR renter.phone = ?",
+		},
+		{
+			name:        "RO前缀订单号路由至rental_orders(order_no)",
+			query:       AdminOrderQuery{Keyword: "RO202609051000"},
+			wantSQLFrag: "o.order_no = ?",
+		},
+		{
+			name:        "长纯数字订单号路由至rental_orders(order_no)",
+			query:       AdminOrderQuery{Keyword: "2026090510001234"},
+			wantSQLFrag: "o.order_no = ?",
+		},
+		{
+			name:        "L前缀商品编号路由至rental_listings(listing_no)",
+			query:       AdminOrderQuery{Keyword: "L20260905100"},
+			wantSQLFrag: "l.listing_no = ?",
+		},
+		{
+			name:        "短数字ID路由至主键及关联ID",
+			query:       AdminOrderQuery{Keyword: "12345"},
+			wantSQLFrag: "o.id = ? OR o.listing_id = ? OR o.owner_id = ? OR o.renter_id = ?",
+		},
+		{
+			name:        "普通文字退回多列LIKE模糊匹配",
+			query:       AdminOrderQuery{Keyword: "测试账号"},
+			wantSQLFrag: "o.order_no LIKE ? OR l.listing_no LIKE ? OR a.title LIKE ? OR owner.phone LIKE ? OR renter.phone LIKE ?",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			stmt := applyAdminOrderFilters(db.Table("rental_orders AS o"), tt.query).Find(&[]struct{}{}).Statement
+			sql := stmt.SQL.String()
+			if !strings.Contains(sql, tt.wantSQLFrag) {
+				t.Fatalf("期望 SQL 包含 %q, 实际生成: %s", tt.wantSQLFrag, sql)
+			}
+		})
+	}
+}
+