feat(distribution): 支持分站独立短信验证码通道

- 新增分销站点独立短信服务商配置（阿里云），登录验证码按 site_code/domain
  解析专属通道，未启用或解析失败时回退主站默认通道
- 密钥经 crypto.Encryptor 加密落库，模型字段 json 序列化隔离，DTO 仅回传掩码
- provider 白名单校验，mock 仅在非生产环境放行；启用时强制校验必填凭据
- 配置读写/测试接口限管理员权限，测试发送增加 60s 频控（Redis，缺省进程内）
- 解密失败记告警并优雅回退主站，避免把密文当明文密钥使用
- 两套前端新增短信配置入口、必填与手机号校验、发送冷却
- 新增迁移 000071 及加解密、白名单、频控、解析回退等单测

backend/internal/modules/auth/handler.go

@@ -2,6 +2,7 @@ package auth
 
 import (
 	"errors"
+	"net"
 	"net/http"
 	"strings"
 
@@ -18,6 +19,7 @@ type SendSMSRequest struct {
 	Phone       string `json:"phone" binding:"required"`
 	CaptchaID   string `json:"captcha_id" binding:"required"`
 	CaptchaCode string `json:"captcha_code" binding:"required"`
+	SiteCode    string `json:"site_code"`
 }
 
 type LoginRequest struct {
@@ -83,13 +85,52 @@ func (h *Handler) SendSMS(c *gin.Context) {
 		response.BadRequest(c, "手机号和图形验证码不能为空")
 		return
 	}
-	if err := h.service.SendSMSCode(c.Request.Context(), strings.TrimSpace(req.Phone), strings.TrimSpace(req.CaptchaID), strings.TrimSpace(req.CaptchaCode)); err != nil {
+
+	siteCode := strings.TrimSpace(firstNonEmpty(
+		c.GetHeader("X-Distribution-Site-Code"),
+		c.Query("distribution_site_code"),
+		c.Query("site_code"),
+		req.SiteCode,
+	))
+	domain := strings.TrimSpace(firstNonEmpty(
+		c.GetHeader("X-Distribution-Domain"),
+		c.Query("distribution_domain"),
+		c.Query("domain"),
+	))
+	if siteCode == "" && domain == "" {
+		host := extractHost(c.Request.Host)
+		if host != "" && host != "localhost" && host != "127.0.0.1" && host != "::1" {
+			domain = host
+		}
+	}
+
+	if err := h.service.SendSMSCode(c.Request.Context(), strings.TrimSpace(req.Phone), strings.TrimSpace(req.CaptchaID), strings.TrimSpace(req.CaptchaCode), siteCode, domain); err != nil {
 		writeAuthError(c, err)
 		return
 	}
 	response.OK(c, gin.H{"phone": PublicPhone(req.Phone), "expires_in": 300})
 }
 
+func firstNonEmpty(items ...string) string {
+	for _, item := range items {
+		if strings.TrimSpace(item) != "" {
+			return item
+		}
+	}
+	return ""
+}
+
+func extractHost(rawHost string) string {
+	rawHost = strings.TrimSpace(rawHost)
+	if rawHost == "" {
+		return ""
+	}
+	if host, _, err := net.SplitHostPort(rawHost); err == nil {
+		return strings.Trim(host, "[]")
+	}
+	return strings.Trim(rawHost, "[]")
+}
+
 // Login 短信验证码登录
 // @Summary      短信验证码登录
 // @Description  使用手机号和验证码登录