订单接口最小化与私有文件访问加固

- 订单列表使用独立最小 DTO 并分页，号主待办提供独立接口与统计
- 用户 token 增加版本控制，冻结/改密/退出即时撤销会话
- 移除 URL token 传参，SSE 与接口统一使用 HttpOnly Cookie
- 私有文件按上传归属与业务关联授权，收款凭证转私有访问并校验归属
- 公开商品接口返回最小字段，隐藏号主身份与内部状态
- 每日清理超过 30 天未关联业务的上传归属，上传归属失败时补偿删除对象

backend/internal/modules/order/presenter.go

@@ -2,6 +2,7 @@ package order
 
 import (
 	"encoding/json"
+	"time"
 
 	"hfb_sys/backend/internal/model"
 
@@ -150,6 +151,63 @@ func (row orderRow) toDTOForUser(userID uint64) OrderDTO {
 	return dto
 }
 
+func (row orderRow) toUserListItem(userID uint64, paymentDeadlineAt *time.Time) UserOrderListItemDTO {
+	role := "renter"
+	if userID == row.OwnerID {
+		role = "owner"
+	}
+	displayAmountCent := row.RentAmountCent
+	if role == "owner" && row.OwnerRentAmountCent > 0 {
+		displayAmountCent = row.OwnerRentAmountCent
+	}
+	return UserOrderListItemDTO{
+		ID:                      row.ID,
+		OrderNo:                 row.OrderNo,
+		ListingID:               row.ListingID,
+		ListingNo:               row.ListingNo,
+		Role:                    role,
+		Title:                   row.Title,
+		ServerRegion:            row.ServerRegion,
+		LoginPlatform:           row.LoginPlatform,
+		DisplayAmountCent:       displayAmountCent,
+		DepositAmountCent:       row.DepositAmountCent,
+		DepositWaivedAmountCent: row.DepositWaivedAmountCent,
+		Status:                  row.Status,
+		HandoffStatus:           row.HandoffStatus,
+		PaymentDeadlineAt:       paymentDeadlineAt,
+		CreatedAt:               row.CreatedAt,
+	}
+}
+
+func (row orderRow) toAdminListItem() AdminOrderListItemDTO {
+	return AdminOrderListItemDTO{
+		ID:                row.ID,
+		OrderNo:           row.OrderNo,
+		ListingID:         row.ListingID,
+		ListingNo:         row.ListingNo,
+		OwnerPhone:        maskPhone(row.OwnerPhone),
+		RenterPhone:       maskPhone(row.RenterPhone),
+		Title:             row.Title,
+		ServerRegion:      row.ServerRegion,
+		LoginPlatform:     row.LoginPlatform,
+		RentAmountCent:    row.RentAmountCent,
+		DepositAmountCent: row.DepositAmountCent,
+		Status:            row.Status,
+		HandoffStatus:     row.HandoffStatus,
+		HandoffMode:       effectiveHandoffMode(row.RentalOrder),
+		SettlementMode:    effectiveSettlementMode(row.RentalOrder),
+		SettlementStatus:  row.SettlementStatus,
+		CreatedAt:         row.CreatedAt,
+	}
+}
+
+func maskPhone(phone string) string {
+	if len(phone) < 7 {
+		return ""
+	}
+	return phone[:3] + "****" + phone[len(phone)-4:]
+}
+
 func effectiveHandoffMode(order model.RentalOrder) string {
 	if order.HandoffMode != "" {
 		return order.HandoffMode