feat(pdd): 拼多多订单支持 out_sku_sn 匹配与浏览器插件加密保活

- 拼多多进单 Cookie 失效即时拦截与告警修复（支持 43001 会话过期等错误识别）
- 拼多多订单映射优先使用 out_sku_sn（外部商家编码）作为商品规格与工单匹配核心字段
- 新增 Chrome/Edge 浏览器扩展 (Manifest V3)，支持端到端 RSA-OAEP + AES-256-GCM 信封加密自动保活
- 后台店铺管理新增插件配对面板、专属密钥管理与一键导入配置 JSON

apps/backend/src/services/worker-platform/sync-worker-orders-service.ts

@@ -62,8 +62,11 @@ export async function syncWorkerOrdersForSourceOrder(
     const itemTitle =
       matchContext.itemTitle ||
       String(snapshot.goodsName || snapshot.goods_name || item.sku_name || '').trim()
-    const relSkuId = matchContext.relSkuId || String(snapshot.spec || item.sku_code || '').trim()
-    const skuNick = matchContext.skuNick || String(snapshot.spec || item.sku_name || '').trim()
+    const outSkuSn = String(snapshot.out_sku_sn || snapshot.outSkuSn || '').trim()
+    const relSkuId =
+      matchContext.relSkuId || String(outSkuSn || snapshot.spec || item.sku_code || '').trim()
+    const skuNick =
+      matchContext.skuNick || String(outSkuSn || snapshot.spec || item.sku_name || '').trim()
 
     // Record product match diagnostics for all platform orders (including PDD)
     if (sellerId || relItemId || itemTitle) {

apps/backend/src/services/worker-platform/work-product-match-mappers.ts

@@ -149,14 +149,22 @@ export function resolveKuaishouWorkProductMatchContext(
 ): KuaishouWorkProductMatchContext {
   const snapshot = safeParseJson(item.item_snapshot_json)
   const source = safeParseJson(snapshot.kuaishouSendCode)
+  const outSkuSn = String(snapshot.out_sku_sn || snapshot.outSkuSn || '').trim()
   return {
     sellerId: String(source.sellerId || '').trim(),
     itemId: String(source.itemId || '').trim(),
-    relItemId: normalizeExternalMatchId(source.relItemId),
-    skuId: String(source.skuId || '').trim(),
-    relSkuId: normalizeExternalMatchId(source.relSkuId),
-    itemTitle: String(source.itemTitle || '').trim(),
-    skuNick: String(source.skuNick || source.skuName || snapshot.externalSkuName || '').trim(),
+    relItemId: normalizeExternalMatchId(source.relItemId || snapshot.goodsId || snapshot.goods_id),
+    skuId: String(source.skuId || snapshot.sku_id || '').trim(),
+    relSkuId: normalizeExternalMatchId(source.relSkuId || outSkuSn || snapshot.spec),
+    itemTitle: String(source.itemTitle || snapshot.goodsName || snapshot.goods_name || '').trim(),
+    skuNick: String(
+      source.skuNick ||
+        source.skuName ||
+        outSkuSn ||
+        snapshot.externalSkuName ||
+        snapshot.spec ||
+        '',
+    ).trim(),
   }
 }
 
@@ -284,12 +292,15 @@ function scoreWorkProductRule(order: OrderRow, item: OrderItemRow, rule: WorkPro
     return { rule, score }
   }
 
-  const skuCodes = [item.sku_code, snapshot.externalSkuCode, snapshot.externalItemId]
+  const outSkuSn = String(snapshot.out_sku_sn || snapshot.outSkuSn || '').trim()
+  const skuCodes = [item.sku_code, snapshot.externalSkuCode, outSkuSn, snapshot.externalItemId]
     .map(normalizeMatchId)
     .filter(Boolean)
   const skuNames = [
     item.sku_name,
     snapshot.externalSkuName,
+    outSkuSn,
+    snapshot.spec,
     snapshot.externalSkuNameNormalized,
     source.skuNick,
     source.itemTitle,

apps/backend/src/services/worker-platform/worker-platform-service.test.ts

@@ -576,6 +576,32 @@ test('商品映射不以公共词包含匹配，完整大标题不同则不命
   assert.equal(decision.rule, null)
 })
 
+test('拼多多订单使用 out_sku_sn 字段精准匹配接单规则', () => {
+  const rule = buildProductRule({
+    provider: 'pdd',
+    platform: 'pdd',
+    sku_code: '安卓血宴3钻',
+    product_name: '安卓血宴3钻',
+    match_type: 'exact',
+  })
+  const order = { ...buildOrderRow(), provider: 'pdd', platform: 'pdd' }
+  const item = {
+    ...buildOrderItemRow(),
+    sku_code: '安卓血宴3钻',
+    sku_name: '安卓血宴3钻',
+    item_snapshot_json: {
+      goods_id: 12345678,
+      goods_name: '和平精英苏尔南手枪皮肤',
+      spec: '暗潮1钻',
+      out_sku_sn: '安卓血宴3钻',
+    },
+  }
+
+  const decision = resolveMatchingProductRuleDecision(order, item, [rule], [])
+  assert.equal(decision.reason, 'matched')
+  assert.equal(decision.rule?.id, rule.id)
+})
+
 test('assertWorkerLoginAllowed blocks rejected (frozen) workers with worker_rejected', () => {
   assert.throws(
     () => assertWorkerLoginAllowed(buildWorkerUserRow({ status: 'rejected' })),