功能：完善登录安全与客服手动下单

backend/internal/handler/auth.go

@@ -43,3 +43,21 @@ func (h *AuthHandler) Profile(c *gin.Context) {
 	}
 	response.OK(c, user)
 }
+
+type changePasswordReq struct {
+	CurrentPassword string `json:"current_password" binding:"required"`
+	NewPassword     string `json:"new_password" binding:"required,min=8"`
+}
+
+func (h *AuthHandler) ChangePassword(c *gin.Context) {
+	var req changePasswordReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "请填写当前密码和至少 8 位的新密码")
+		return
+	}
+	if err := h.svc.ChangePassword(middleware.GetUserID(c), req.CurrentPassword, req.NewPassword); err != nil {
+		response.BadRequest(c, err.Error())
+		return
+	}
+	response.OK(c, nil)
+}

backend/internal/handler/merchant.go

@@ -101,6 +101,16 @@ func (h *MerchantHandler) ListOrders(c *gin.Context) {
 	response.Page(c, list, total, page, size)
 }
 
+// ListManualOrderProducts returns active products for order creation without granting product-management access.
+func (h *MerchantHandler) ListManualOrderProducts(c *gin.Context) {
+	list, _, err := h.merchantSvc.ListMerchantProducts(middleware.GetMerchantID(c), 1, 100, true)
+	if err != nil {
+		response.ServerError(c, err.Error())
+		return
+	}
+	response.OK(c, list)
+}
+
 type merchantManualOrderReq struct {
 	ClientOrderNo  string `json:"client_order_no" binding:"required,max=96"`
 	SKU            string `json:"sku" binding:"required,max=96"`