对接皮肤源头开放接口：查询、发货推送与 HMAC 签名鉴权

- 新增订单查询与发货结果推送开放接口，支持 can_ship 与幂等
- 鉴权采用 X-Api-Key + Timestamp + Nonce + HMAC-SHA256 签名
- 订单扩展发货字段与 ship_logs，管理端增加发货记录与开放文档页

backend/cmd/server/main.go

@@ -33,7 +33,7 @@ func main() {
 		log.Fatalf("open db: %v", err)
 	}
 
-	if err := db.AutoMigrate(&model.User{}, &model.Skin{}, &model.Order{}); err != nil {
+	if err := db.AutoMigrate(&model.User{}, &model.Skin{}, &model.Order{}, &model.ShipLog{}); err != nil {
 		log.Fatalf("migrate: %v", err)
 	}
 
@@ -51,17 +51,22 @@ func main() {
 	}
 
 	h := &router.Handlers{
-		Auth:  handler.NewAuthHandler(authSvc),
-		Skin:  handler.NewSkinHandler(skinSvc),
-		Order: handler.NewOrderHandler(orderSvc),
-		User:  handler.NewUserHandler(userSvc),
-		JWT:   jm,
+		Auth:          handler.NewAuthHandler(authSvc),
+		Skin:          handler.NewSkinHandler(skinSvc),
+		Order:         handler.NewOrderHandler(orderSvc),
+		User:          handler.NewUserHandler(userSvc),
+		Open:          handler.NewOpenHandler(orderSvc),
+		JWT:           jm,
+		OpenAPIKey:    cfg.OpenAPIKey,
+		OpenAPISecret: cfg.OpenAPISecret,
+		OpenSignSkew:  cfg.OpenSignSkew,
 	}
 
 	r := router.Setup(h)
 	addr := ":" + cfg.Port
 	log.Printf("游戏皮肤分销系统 API 启动: http://localhost%s", addr)
 	log.Printf("默认管理员: admin / admin123")
+	log.Printf("开放接口鉴权: X-Api-Key + X-Timestamp + X-Nonce + X-Sign (HMAC-SHA256)")
 	if err := r.Run(addr); err != nil {
 		log.Fatalf("server: %v", err)
 	}