对接皮肤源头开放接口：查询、发货推送与 HMAC 签名鉴权

- 新增订单查询与发货结果推送开放接口，支持 can_ship 与幂等
- 鉴权采用 X-Api-Key + Timestamp + Nonce + HMAC-SHA256 签名
- 订单扩展发货字段与 ship_logs，管理端增加发货记录与开放文档页

backend/internal/router/router.go

@@ -11,11 +11,15 @@ import (
 )
 
 type Handlers struct {
-	Auth  *handler.AuthHandler
-	Skin  *handler.SkinHandler
-	Order *handler.OrderHandler
-	User  *handler.UserHandler
-	JWT   *jwt.Manager
+	Auth          *handler.AuthHandler
+	Skin          *handler.SkinHandler
+	Order         *handler.OrderHandler
+	User          *handler.UserHandler
+	Open          *handler.OpenHandler
+	JWT           *jwt.Manager
+	OpenAPIKey    string
+	OpenAPISecret string
+	OpenSignSkew  int64
 }
 
 func Setup(h *Handlers) *gin.Engine {
@@ -24,7 +28,7 @@ func Setup(h *Handlers) *gin.Engine {
 	r.Use(cors.New(cors.Config{
 		AllowOrigins:     []string{"http://localhost:5173", "http://127.0.0.1:5173"},
 		AllowMethods:     []string{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"},
-		AllowHeaders:     []string{"Origin", "Content-Type", "Authorization"},
+		AllowHeaders:     []string{"Origin", "Content-Type", "Authorization", "X-Api-Key", "X-Timestamp", "X-Nonce", "X-Sign"},
 		ExposeHeaders:    []string{"Content-Length"},
 		AllowCredentials: true,
 	}))
@@ -38,6 +42,18 @@ func Setup(h *Handlers) *gin.Engine {
 		api.POST("/auth/login", h.Auth.Login)
 		api.POST("/auth/register", h.Auth.Register)
 
+		// 皮肤源头开放接口（ApiKey + HMAC 签名）
+		open := api.Group("/open/v1")
+		open.Use(middleware.OpenAuth(middleware.OpenAuthConfig{
+			APIKey:      h.OpenAPIKey,
+			APISecret:   h.OpenAPISecret,
+			SkewSeconds: h.OpenSignSkew,
+		}))
+		{
+			open.GET("/orders/:order_no", h.Open.QueryOrder)
+			open.POST("/orders/ship-notify", h.Open.ShipNotify)
+		}
+
 		auth := api.Group("")
 		auth.Use(middleware.Auth(h.JWT))
 		{
@@ -56,13 +72,14 @@ func Setup(h *Handlers) *gin.Engine {
 			auth.POST("/orders", h.Order.Create)
 			auth.PATCH("/orders/:id/status", middleware.RequireRole(model.RoleAdmin), h.Order.UpdateStatus)
 
-			// 用户 / 分销商（仅管理员）
+			// 用户 / 分销商 / 发货记录（仅管理员）
 			admin := auth.Group("")
 			admin.Use(middleware.RequireRole(model.RoleAdmin))
 			{
 				admin.GET("/users", h.User.List)
 				admin.POST("/users", h.User.Create)
 				admin.PATCH("/users/:id/status", h.User.UpdateStatus)
+				admin.GET("/ship-logs", h.Order.ListShipLogs)
 			}
 		}
 	}