拆分 service 与前端大文件,修复 CORS 配置与格式问题

- 后端 internal/service 按职责拆分:
  fulfillment.go(1397→527)拆出 wallet/timeout/data/order/query/dashboard/shipnotify
  delivery.go(1124→801)拆出 upstream/link/state/helpers
  merchant.go(855→251)拆出 member/product/api_client/catalog/helpers
- 前端 MerchantCenter.tsx(1327→606)拆出 merchantCenterTabs/merchantCenterUtils
- docker-compose backend 透传 CORS_ALLOWED_ORIGINS
- CORS 白名单实现(config/router/README/.env.example 配套)
- 修复 gofmt 与文件尾部多余空行

backend/internal/router/router.go

@@ -1,6 +1,8 @@
 package router
 
 import (
+	"strings"
+
 	"affiliate_dash/internal/handler"
 	"affiliate_dash/internal/middleware"
 	"affiliate_dash/internal/model"
@@ -30,6 +32,33 @@ type Handlers struct {
 	OpenSignSkew  int64
 	OpenAPIDebug  bool
 	UploadDir     string
+	// CORSAllowedOrigins 跨域来源白名单;为空时使用本地开发默认来源。
+	CORSAllowedOrigins []string
+}
+
+// defaultCORSOrigins 未配置 CORS_ALLOWED_ORIGINS 时的本地开发默认来源。
+var defaultCORSOrigins = []string{
+	"http://localhost:15173",
+	"http://127.0.0.1:15173",
+	"http://localhost:18080",
+	"http://127.0.0.1:18080",
+}
+
+// corsOrigins 返回生效的 CORS 来源白名单,并拒绝通配符 "*"
+// (与 AllowCredentials 组合会让浏览器把凭证请求放行给任意站点)。
+func corsOrigins(h *Handlers) []string {
+	var origins []string
+	for _, o := range h.CORSAllowedOrigins {
+		o = strings.TrimSpace(o)
+		if o == "" || o == "*" {
+			continue
+		}
+		origins = append(origins, o)
+	}
+	if len(origins) == 0 {
+		return defaultCORSOrigins
+	}
+	return origins
 }
 
 // requestLogger 访问日志中间件：跳过 /health 健康检查（每 30 秒一次，避免刷屏）。
@@ -49,7 +78,7 @@ func Setup(h *Handlers) *gin.Engine {
 	r.Use(requestLogger(), gin.Recovery())
 
 	r.Use(cors.New(cors.Config{
-		AllowOrigins:     []string{"*"},
+		AllowOrigins:     corsOrigins(h),
 		AllowMethods:     []string{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"},
 		AllowHeaders:     []string{"Origin", "Content-Type", "Authorization", "X-Merchant-ID", "X-App-Key", "X-Api-Key", "X-Timestamp", "X-Nonce", "X-Sign", "X-Request-ID"},
 		ExposeHeaders:    []string{"Content-Length", "X-Request-ID"},