订单接口最小化与私有文件访问加固

- 订单列表使用独立最小 DTO 并分页，号主待办提供独立接口与统计
- 用户 token 增加版本控制，冻结/改密/退出即时撤销会话
- 移除 URL token 传参，SSE 与接口统一使用 HttpOnly Cookie
- 私有文件按上传归属与业务关联授权，收款凭证转私有访问并校验归属
- 公开商品接口返回最小字段，隐藏号主身份与内部状态
- 每日清理超过 30 天未关联业务的上传归属，上传归属失败时补偿删除对象

backend/internal/modules/listing/presenter.go

@@ -71,9 +71,100 @@ func applyPublicListingURLs(item *ListingDTO) {
 	if item.AssetSummary != nil {
 		delete(item.AssetSummary, "import_meta")
 		delete(item.AssetSummary, "price_breakdown")
+		// 截图分组可能保留原始对象 URL，公开详情统一使用受控图片接口。
+		delete(item.AssetSummary, "screenshot_groups")
 	}
 }
 
+func publicListingListItems(items []ListingDTO) []PublicListingListItemDTO {
+	result := make([]PublicListingListItemDTO, 0, len(items))
+	for _, item := range items {
+		result = append(result, item.toPublicListItem())
+	}
+	return result
+}
+
+func (item ListingDTO) toPublicListItem() PublicListingListItemDTO {
+	return PublicListingListItemDTO{
+		ID:                item.ID,
+		ListingNo:         item.ListingNo,
+		Title:             item.Title,
+		GameName:          item.GameName,
+		ServerRegion:      item.ServerRegion,
+		LoginPlatform:     item.LoginPlatform,
+		RankLevel:         item.RankLevel,
+		HafCoinAmount:     item.HafCoinAmount,
+		AssetSummary:      publicListAssetSummary(item.AssetSummary),
+		CoverURL:          item.CoverURL,
+		PriceCent:         item.PriceCent,
+		DepositAmountCent: item.DepositAmountCent,
+		IsAccelerated:     item.IsAccelerated,
+		PublishedAt:       item.PublishedAt,
+		CreatedAt:         item.CreatedAt,
+	}
+}
+
+func (item ListingDTO) toPublicDetail() PublicListingDetailDTO {
+	listItem := item.toPublicListItem()
+	listItem.AssetSummary = publicDetailAssetSummary(item.AssetSummary)
+	return PublicListingDetailDTO{
+		PublicListingListItemDTO: listItem,
+		Description:              item.Description,
+		ScreenshotURLS:           item.ScreenshotURLS,
+	}
+}
+
+// publicListAssetSummary 仅保留首页卡片和筛选展示所需资产字段。
+func publicListAssetSummary(summary map[string]any) map[string]any {
+	return selectPublicAssetSummary(summary, []string{
+		"season_insurance",
+		"stamina_level",
+		"load_level",
+		"resources",
+		"skin_groups",
+		"total_asset_wan",
+		"online_time",
+		"can_change_game_name",
+		"all_hero",
+		"daily_loss_m",
+		"publish_ratio",
+	})
+}
+
+// publicDetailAssetSummary 仅保留公开详情明确展示的资产字段。
+func publicDetailAssetSummary(summary map[string]any) map[string]any {
+	return selectPublicAssetSummary(summary, []string{
+		"season_insurance",
+		"stamina_level",
+		"load_level",
+		"resources",
+		"skin_groups",
+		"total_asset_wan",
+		"online_time",
+		"can_change_game_name",
+		"all_hero",
+		"daily_loss_m",
+		"publish_ratio",
+		"secret_kd",
+		"fire_level",
+		"common_regions",
+		"ban_record",
+	})
+}
+
+func selectPublicAssetSummary(summary map[string]any, keys []string) map[string]any {
+	if len(summary) == 0 {
+		return nil
+	}
+	result := make(map[string]any, len(keys))
+	for _, key := range keys {
+		if value, ok := summary[key]; ok {
+			result[key] = value
+		}
+	}
+	return result
+}
+
 func applySellerListingPrice(item *ListingDTO) {
 	if item == nil {
 		return