对接皮肤源头开放接口：查询、发货推送与 HMAC 签名鉴权

- 新增订单查询与发货结果推送开放接口，支持 can_ship 与幂等
- 鉴权采用 X-Api-Key + Timestamp + Nonce + HMAC-SHA256 签名
- 订单扩展发货字段与 ship_logs，管理端增加发货记录与开放文档页

backend/internal/handler/open.go

@@ -0,0 +1,86 @@
+package handler
+
+import (
+	"encoding/json"
+	"time"
+
+	"affiliate_dash/internal/pkg/response"
+	"affiliate_dash/internal/service"
+
+	"github.com/gin-gonic/gin"
+)
+
+// OpenHandler 皮肤源头开放接口
+type OpenHandler struct {
+	orderSvc *service.OrderService
+}
+
+func NewOpenHandler(orderSvc *service.OrderService) *OpenHandler {
+	return &OpenHandler{orderSvc: orderSvc}
+}
+
+// QueryOrder GET /api/open/v1/orders/:order_no
+// 上游输入店铺订单号，查询商品与是否可发货
+func (h *OpenHandler) QueryOrder(c *gin.Context) {
+	orderNo := c.Param("order_no")
+	if orderNo == "" {
+		orderNo = c.Query("order_no")
+	}
+	data, err := h.orderSvc.QueryOpenOrder(orderNo)
+	if err != nil {
+		if err.Error() == "订单不存在" {
+			response.NotFound(c, err.Error())
+			return
+		}
+		response.BadRequest(c, err.Error())
+		return
+	}
+	response.OK(c, data)
+}
+
+type shipNotifyReq struct {
+	OrderNo         string `json:"order_no" binding:"required"`
+	ShipStatus      string `json:"ship_status" binding:"required"` // success/failed/processing
+	ProviderOrderNo string `json:"provider_order_no"`
+	ShippedAt       string `json:"shipped_at"` // RFC3339 可选
+	FailReason      string `json:"fail_reason"`
+}
+
+// ShipNotify POST /api/open/v1/orders/ship-notify
+// 上游发货后推送结果，同步订单状态
+func (h *OpenHandler) ShipNotify(c *gin.Context) {
+	var req shipNotifyReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "参数错误：order_no 与 ship_status 必填")
+		return
+	}
+
+	raw, _ := json.Marshal(req)
+	var shippedAt *time.Time
+	if req.ShippedAt != "" {
+		t, err := time.Parse(time.RFC3339, req.ShippedAt)
+		if err != nil {
+			response.BadRequest(c, "shipped_at 格式错误，请使用 RFC3339，如 2026-07-20T16:00:00+08:00")
+			return
+		}
+		shippedAt = &t
+	}
+
+	result, err := h.orderSvc.HandleShipNotify(service.ShipNotifyInput{
+		OrderNo:         req.OrderNo,
+		ShipStatus:      req.ShipStatus,
+		ProviderOrderNo: req.ProviderOrderNo,
+		ShippedAt:       shippedAt,
+		FailReason:      req.FailReason,
+		RawPayload:      string(raw),
+	})
+	if err != nil {
+		if err.Error() == "订单不存在" {
+			response.NotFound(c, err.Error())
+			return
+		}
+		response.BadRequest(c, err.Error())
+		return
+	}
+	response.OK(c, result)
+}