回调优化为单地址 upsert 配置并支持重置密钥

- 回调订阅改为单记录 upsert：保存即覆盖（URL/事件/状态），自动停用其他订阅，无新增/删除
- 新增重置密钥：保存时传 rotate_secret=true 重新生成密钥并返回一次，解决密钥丢失无法找回
- 删除不再使用的 PATCH /callbacks/:id/status 路由及对应 handler/service 死代码
- 前端回调页改为内联表单（URL/事件/状态），新增重置密钥按钮（确认后展示新密钥一次）
- 补充单地址复用、disabled 不投递、密钥轮换测试

backend/internal/handler/merchant.go

@@ -313,30 +313,34 @@ func (h *MerchantHandler) DeleteAPIClient(c *gin.Context) {
 }
 
 func (h *MerchantHandler) ListCallbacks(c *gin.Context) {
-	list, err := h.callbackSvc.ListSubscriptions(middleware.GetMerchantID(c))
+	subscription, err := h.callbackSvc.GetSubscription(middleware.GetMerchantID(c))
 	if err != nil {
 		response.ServerError(c, err.Error())
 		return
 	}
-	response.OK(c, list)
+	response.OK(c, subscription)
 }
 
 type callbackReq struct {
-	Name   string `json:"name" binding:"required"`
-	URL    string `json:"url" binding:"required"`
-	Events string `json:"events" binding:"required"`
+	Name        string `json:"name"`
+	URL         string `json:"url" binding:"required"`
+	Events      string `json:"events" binding:"required"`
+	Status      string `json:"status"`
+	RotateSecret bool   `json:"rotate_secret"`
 }
 
 func (h *MerchantHandler) CreateCallback(c *gin.Context) {
 	var req callbackReq
 	if err := c.ShouldBindJSON(&req); err != nil {
-		response.BadRequest(c, "参数错误：name、url、events 必填")
+		response.BadRequest(c, "参数错误：url、events 必填")
 		return
 	}
 	credential, err := h.callbackSvc.CreateSubscription(middleware.GetMerchantID(c), service.CreateCallbackInput{
-		Name:   req.Name,
-		URL:    req.URL,
-		Events: req.Events,
+		Name:        req.Name,
+		URL:         req.URL,
+		Events:      req.Events,
+		Status:      req.Status,
+		RotateSecret: req.RotateSecret,
 	}, middleware.GetUserID(c))
 	if err != nil {
 		response.BadRequest(c, err.Error())
@@ -345,20 +349,6 @@ func (h *MerchantHandler) CreateCallback(c *gin.Context) {
 	response.OK(c, credential)
 }
 
-func (h *MerchantHandler) UpdateCallbackStatus(c *gin.Context) {
-	var req statusReq
-	if err := c.ShouldBindJSON(&req); err != nil {
-		response.BadRequest(c, "参数错误")
-		return
-	}
-	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
-	if err := h.callbackSvc.UpdateSubscriptionStatus(middleware.GetMerchantID(c), uint(id), req.Status, middleware.GetUserID(c)); err != nil {
-		response.BadRequest(c, err.Error())
-		return
-	}
-	response.OK(c, nil)
-}
-
 func (h *MerchantHandler) ListMembers(c *gin.Context) {
 	members, err := h.merchantSvc.ListMembers(middleware.GetMerchantID(c))
 	if err != nil {