对接皮肤源头开放接口：查询、发货推送与 HMAC 签名鉴权

- 新增订单查询与发货结果推送开放接口，支持 can_ship 与幂等
- 鉴权采用 X-Api-Key + Timestamp + Nonce + HMAC-SHA256 签名
- 订单扩展发货字段与 ship_logs，管理端增加发货记录与开放文档页

backend/internal/model/models.go

@@ -63,14 +63,43 @@ type Order struct {
 	BuyerName      string  `gorm:"size:64" json:"buyer_name"`
 	Amount         float64 `gorm:"not null" json:"amount"`
 	CommissionAmt  float64 `gorm:"default:0" json:"commission_amt"`
-	Status         string  `gorm:"size:32;default:pending" json:"status"` // pending/paid/delivered/cancelled
+	Status         string  `gorm:"size:32;default:pending;index" json:"status"`
 	Remark         string  `gorm:"size:255" json:"remark"`
+
+	// 发货相关（上游皮肤源头对接）
+	ProviderOrderNo string     `gorm:"size:64;index" json:"provider_order_no"` // 上游单号
+	ShippedAt       *time.Time `json:"shipped_at"`                             // 发货成功时间
+	ShipFailReason  string     `gorm:"size:512" json:"ship_fail_reason"`       // 最近一次失败原因
 }
 
 // 订单状态
 const (
-	OrderStatusPending   = "pending"
-	OrderStatusPaid      = "paid"
-	OrderStatusDelivered = "delivered"
-	OrderStatusCancelled = "cancelled"
+	OrderStatusPending    = "pending"     // 待支付
+	OrderStatusPaid       = "paid"        // 已支付，可发货
+	OrderStatusDelivering = "delivering"  // 发货中
+	OrderStatusDelivered  = "delivered"   // 已交付
+	OrderStatusShipFailed = "ship_failed" // 发货失败（可重试）
+	OrderStatusCancelled  = "cancelled"   // 已取消
 )
+
+// 上游推送的发货状态
+const (
+	ShipNotifySuccess    = "success"
+	ShipNotifyFailed     = "failed"
+	ShipNotifyProcessing = "processing"
+)
+
+// ShipLog 发货推送记录（上游回调留痕）
+type ShipLog struct {
+	ID        uint      `gorm:"primarykey" json:"id"`
+	CreatedAt time.Time `json:"created_at"`
+
+	OrderNo         string `gorm:"size:64;index;not null" json:"order_no"`
+	OrderID         uint   `gorm:"index" json:"order_id"`
+	ShipStatus      string `gorm:"size:32;not null" json:"ship_status"` // success/failed/processing
+	ProviderOrderNo string `gorm:"size:64" json:"provider_order_no"`
+	FailReason      string `gorm:"size:512" json:"fail_reason"`
+	Payload         string `gorm:"type:text" json:"payload"` // 原始请求 JSON
+	ResultStatus    string `gorm:"size:32" json:"result_status"` // 处理后订单状态
+	Message         string `gorm:"size:255" json:"message"`
+}