拆分 service 与前端大文件,修复 CORS 配置与格式问题

- 后端 internal/service 按职责拆分:
  fulfillment.go(1397→527)拆出 wallet/timeout/data/order/query/dashboard/shipnotify
  delivery.go(1124→801)拆出 upstream/link/state/helpers
  merchant.go(855→251)拆出 member/product/api_client/catalog/helpers
- 前端 MerchantCenter.tsx(1327→606)拆出 merchantCenterTabs/merchantCenterUtils
- docker-compose backend 透传 CORS_ALLOWED_ORIGINS
- CORS 白名单实现(config/router/README/.env.example 配套)
- 修复 gofmt 与文件尾部多余空行

backend/cmd/server/main.go

@@ -91,23 +91,24 @@ func main() {
 	openlog.Init(cfg.OpenAPIDebug)
 
 	h := &router.Handlers{
-		Auth:          handler.NewAuthHandler(authSvc),
-		Dashboard:     handler.NewDashboardHandler(fulfillmentSvc),
-		Delivery:      handler.NewDeliveryHandler(deliverySvc),
-		User:          handler.NewUserHandler(userSvc),
-		Open:          handler.NewOpenV1Handler(merchantSvc, fulfillmentSvc, deliverySvc),
-		SourceOpen:    handler.NewOpenHandler(fulfillmentSvc),
-		Merchant:      handler.NewMerchantHandler(merchantSvc, fulfillmentSvc, callbackSvc, deliverySvc, rechargeSvc),
-		Recharge:      handler.NewRechargeHandler(rechargeSvc),
-		JWT:           jm,
-		Tenant:        tenantSvc,
-		OpenDB:        db,
-		SecretCodec:   codec,
-		OpenAPIKey:    cfg.OpenAPIKey,
-		OpenAPISecret: cfg.OpenAPISecret,
-		OpenSignSkew:  cfg.OpenSignSkew,
-		OpenAPIDebug:  cfg.OpenAPIDebug,
-		UploadDir:     cfg.UploadDir,
+		Auth:               handler.NewAuthHandler(authSvc),
+		Dashboard:          handler.NewDashboardHandler(fulfillmentSvc),
+		Delivery:           handler.NewDeliveryHandler(deliverySvc),
+		User:               handler.NewUserHandler(userSvc),
+		Open:               handler.NewOpenV1Handler(merchantSvc, fulfillmentSvc, deliverySvc),
+		SourceOpen:         handler.NewOpenHandler(fulfillmentSvc),
+		Merchant:           handler.NewMerchantHandler(merchantSvc, fulfillmentSvc, callbackSvc, deliverySvc, rechargeSvc),
+		Recharge:           handler.NewRechargeHandler(rechargeSvc),
+		JWT:                jm,
+		Tenant:             tenantSvc,
+		OpenDB:             db,
+		SecretCodec:        codec,
+		OpenAPIKey:         cfg.OpenAPIKey,
+		OpenAPISecret:      cfg.OpenAPISecret,
+		OpenSignSkew:       cfg.OpenSignSkew,
+		OpenAPIDebug:       cfg.OpenAPIDebug,
+		UploadDir:          cfg.UploadDir,
+		CORSAllowedOrigins: cfg.CORSAllowedOrigins,
 	}
 
 	go callbackSvc.Run(context.Background())