feat(risk-control): 新增 IP/账号手动封禁，并收口财务同步的全表更新

- 风控：worker_risk_bans 表 + 前置封禁中间件（登录一并拦截）+ 后台列表/新增/解封
- 财务：成本快照补商品维度收口到本批 order_item_id，不再整表扫 899MB 的 order_items
- 性能：order_items 覆盖索引（迁移 110）、大厅 pageSize 上限 20、已读/上传接口限流

apps/backend/src/routes/worker.ts

@@ -7,11 +7,16 @@ import workerHallRoutes from './worker/hall.js'
 import workerOrdersRoutes from './worker/orders.js'
 import workerConsignmentRoutes from './worker/consignment.js'
 import { requireWorkerSession } from './worker/session.js'
+import { createWorkerBanGuardMiddleware } from '../middleware/worker-ban-guard.js'
 import { createWorkerHallRiskMiddleware } from '../middleware/worker-risk-control.js'
 import { buildNotFoundPayload } from '../utils/http.js'
 
 const router = Router()
 
+// 手动封禁（IP / 账号）最先判：命中直接 403，连登录都不放行。
+// 整个过程只查进程内缓存，不碰数据库，被刷时也不会放大压力。
+router.use(createWorkerBanGuardMiddleware())
+
 router.use(workerAuthPublicRoutes)
 
 // 风控限流前置：在校验数据库 session 之前先行拦截超频/风控请求，避免外挂脚本打满数据库连接