拆分 service 与前端大文件,修复 CORS 配置与格式问题

- 后端 internal/service 按职责拆分:
  fulfillment.go(1397→527)拆出 wallet/timeout/data/order/query/dashboard/shipnotify
  delivery.go(1124→801)拆出 upstream/link/state/helpers
  merchant.go(855→251)拆出 member/product/api_client/catalog/helpers
- 前端 MerchantCenter.tsx(1327→606)拆出 merchantCenterTabs/merchantCenterUtils
- docker-compose backend 透传 CORS_ALLOWED_ORIGINS
- CORS 白名单实现(config/router/README/.env.example 配套)
- 修复 gofmt 与文件尾部多余空行

docker-compose.yml

@@ -42,6 +42,7 @@ services:
       - JWT_SECRET=${JWT_SECRET}
       - "DATABASE_URL=${DOCKER_DATABASE_URL:-postgres://${POSTGRES_USER:-affiliate}:${POSTGRES_PASSWORD:-affiliate_dev_password}@postgres:5432/${POSTGRES_DB:-affiliate_dash}?sslmode=disable&TimeZone=${TZ:-Asia/Shanghai}}"
       - GIN_MODE=${GIN_MODE:-release}
+      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-}
       - OPEN_API_KEY=${OPEN_API_KEY}
       - OPEN_API_SECRET=${OPEN_API_SECRET}
       - OPEN_SIGN_SKEW=${OPEN_SIGN_SKEW:-300}