feat(risk-control): 新增 IP/账号手动封禁，并收口财务同步的全表更新

- 风控：worker_risk_bans 表 + 前置封禁中间件（登录一并拦截）+ 后台列表/新增/解封
- 财务：成本快照补商品维度收口到本批 order_item_id，不再整表扫 899MB 的 order_items
- 性能：order_items 覆盖索引（迁移 110）、大厅 pageSize 上限 20、已读/上传接口限流

apps/frontend/src/services/admin/worker-platform.ts

@@ -18,6 +18,9 @@ import type {
   WorkerRiskConfig,
   WorkerRiskOverview,
   WorkerRiskEventList,
+  WorkerRiskBan,
+  WorkerRiskBanList,
+  WorkerRiskBanTargetType,
   WorkerFinanceRequest,
   WorkerCancelRequest,
   WorkerOrderFeedback,
@@ -1021,3 +1024,34 @@ export function releaseAdminWorkerRiskTracker(workerId: number) {
     `/api/v1/admin/worker-platform/risk-control/workers/${workerId}/release`,
   )
 }
+
+/** 手动封禁（IP / 账号）：落库、进程重启不丢，中间件按它拦截整个接单端 */
+export function fetchAdminWorkerRiskBans(params: {
+  page?: number
+  pageSize?: number
+  targetType?: WorkerRiskBanTargetType
+  keyword?: string
+  activeOnly?: boolean
+}) {
+  return apiGet<WorkerRiskBanList>('/api/v1/admin/worker-platform/risk-control/bans', params)
+}
+
+export function createAdminWorkerRiskBan(payload: {
+  targetType: WorkerRiskBanTargetType
+  target: string
+  /** 0 / 不传 = 永久 */
+  durationMinutes?: number
+  reason?: string
+}) {
+  return apiPost<{ ban: WorkerRiskBan; workerId?: number; status?: string }>(
+    '/api/v1/admin/worker-platform/risk-control/bans',
+    payload,
+  )
+}
+
+export function revokeAdminWorkerRiskBan(banId: string, reason?: string) {
+  return apiPost<{ ban: WorkerRiskBan }>(
+    `/api/v1/admin/worker-platform/risk-control/bans/${banId}/revoke`,
+    { reason },
+  )
+}