feat(distribution): 支持分站独立短信验证码通道

- 新增分销站点独立短信服务商配置（阿里云），登录验证码按 site_code/domain
  解析专属通道，未启用或解析失败时回退主站默认通道
- 密钥经 crypto.Encryptor 加密落库，模型字段 json 序列化隔离，DTO 仅回传掩码
- provider 白名单校验，mock 仅在非生产环境放行；启用时强制校验必填凭据
- 配置读写/测试接口限管理员权限，测试发送增加 60s 频控（Redis，缺省进程内）
- 解密失败记告警并优雅回退主站，避免把密文当明文密钥使用
- 两套前端新增短信配置入口、必填与手机号校验、发送冷却
- 新增迁移 000071 及加解密、白名单、频控、解析回退等单测

frontend/src/features/admin/api/adminDistribution.ts

@@ -301,3 +301,64 @@ export async function syncDistributionSiteAccounts(siteId: number, req?: SyncSit
   )
   return data.data
 }
+
+export interface DistributionSiteSMSConfig {
+  enabled: boolean
+  provider: string
+  access_key_id: string
+  masked_secret: string
+  has_secret: boolean
+  endpoint: string
+  sign_name: string
+  login_template_code: string
+}
+
+export interface UpdateDistributionSiteSMSConfigPayload {
+  enabled?: boolean
+  provider?: string
+  access_key_id?: string
+  access_key_secret?: string
+  endpoint?: string
+  sign_name?: string
+  login_template_code?: string
+}
+
+export interface TestDistributionSiteSMSConfigPayload {
+  phone: string
+  enabled?: boolean
+  provider?: string
+  access_key_id?: string
+  access_key_secret?: string
+  endpoint?: string
+  sign_name?: string
+  login_template_code?: string
+}
+
+export async function fetchDistributionSiteSMSConfig(siteId: number) {
+  const { data } = await apiClient.get<ApiResponse<DistributionSiteSMSConfig>>(
+    `/admin/distribution/sites/${siteId}/sms-config`
+  )
+  return data.data
+}
+
+export async function updateDistributionSiteSMSConfig(
+  siteId: number,
+  payload: UpdateDistributionSiteSMSConfigPayload
+) {
+  const { data } = await apiClient.put<ApiResponse<DistributionSiteSMSConfig>>(
+    `/admin/distribution/sites/${siteId}/sms-config`,
+    payload
+  )
+  return data.data
+}
+
+export async function testDistributionSiteSMSConfig(
+  siteId: number,
+  payload: TestDistributionSiteSMSConfigPayload
+) {
+  const { data } = await apiClient.post<ApiResponse<{ message: string }>>(
+    `/admin/distribution/sites/${siteId}/sms-config/test`,
+    payload
+  )
+  return data.data
+}