refactor(openapi): 客户端签名统一为字典序+&拼接风格

- BuildOpenV1Sign 改为 app_key/body_sha256/method/nonce/path/timestamp
  按 ASCII 字典序用 & 拼接，与上游 BuildSignString 风格一致
- body 以 SHA256 摘要参与签名，避免大 body 与特殊字符问题
- 同步更新中间件调用点、测试用例与前端鉴权文档

backend/internal/middleware/open_auth_test.go

@@ -66,7 +66,7 @@ func TestOpenAuthV1AcceptsSignedRequestAndRejectsReplay(t *testing.T) {
 	ts := strconv.FormatInt(time.Now().Unix(), 10)
 	nonce := "nonce-123456"
 	path := "/api/client/v1/orders"
-	sign := BuildOpenV1Sign(secret, ts, nonce, http.MethodPost, path, []byte(body))
+	sign := BuildOpenV1Sign(secret, appKey, ts, nonce, http.MethodPost, path, []byte(body))
 
 	req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(body))
 	req.Header.Set("X-App-Key", appKey)