订单接口最小化与私有文件访问加固

- 订单列表使用独立最小 DTO 并分页，号主待办提供独立接口与统计
- 用户 token 增加版本控制，冻结/改密/退出即时撤销会话
- 移除 URL token 传参，SSE 与接口统一使用 HttpOnly Cookie
- 私有文件按上传归属与业务关联授权，收款凭证转私有访问并校验归属
- 公开商品接口返回最小字段，隐藏号主身份与内部状态
- 每日清理超过 30 天未关联业务的上传归属，上传归属失败时补偿删除对象

backend/internal/router/router.go

@@ -355,7 +355,7 @@ func New(cfg config.Config, deps Dependencies, logger *zap.Logger) *gin.Engine {
 		}
 	}
 	fileService := filemodule.NewService(fileStorage)
-	fileHandler := filemodule.NewHandler(fileService, fileStorage)
+	fileHandler := filemodule.NewHandler(fileService, fileStorage, privateFileAuthorizer(deps.DB), recordPrivateFileUpload(deps.DB))
 	listingService := listing.NewService(listingRepo, systemConfigRepo)
 	listingHandler := listing.NewHandler(listingService, fileStorage, listing.HandlerOptions{
 		ExternalUploadSecret:     cfg.ExternalUploadSecret,
@@ -367,7 +367,14 @@ func New(cfg config.Config, deps Dependencies, logger *zap.Logger) *gin.Engine {
 	}
 	announcementService := announcement.NewService(announcementRepo)
 	announcementHandler := announcement.NewHandler(announcementService)
-	requireAuth := middleware.Auth(jwtManager)
+	var validateUserToken middleware.UserTokenValidatorFunc
+	if userRepo != nil {
+		validateUserToken = func(ctx context.Context, userID uint64, tokenVersion int64) error {
+			_, err := userRepo.FindActiveForToken(ctx, userID, tokenVersion)
+			return err
+		}
+	}
+	requireAuth := middleware.Auth(jwtManager, validateUserToken)
 	var validateAdminToken middleware.AdminTokenValidatorFunc
 	if adminAuthRepo != nil {
 		validateAdminToken = func(ctx context.Context, adminID uint64, tokenVersion int64) (middleware.AdminTokenContext, error) {
@@ -416,7 +423,7 @@ func New(cfg config.Config, deps Dependencies, logger *zap.Logger) *gin.Engine {
 			authRoutes.POST("/password/register", authHandler.Register)
 			authRoutes.POST("/password/reset", authHandler.ResetPassword)
 			authRoutes.POST("/refresh", authHandler.Refresh)
-			authRoutes.POST("/logout", authHandler.Logout)
+			authRoutes.POST("/logout", requireAuth, authHandler.Logout)
 		}
 
 		api.GET("/me", requireAuth, userHandler.Me)
@@ -474,6 +481,7 @@ func New(cfg config.Config, deps Dependencies, logger *zap.Logger) *gin.Engine {
 		{
 			orderRoutes.POST("", requireRealname, orderHandler.Create)
 			orderRoutes.GET("", orderHandler.List)
+			orderRoutes.GET("/handoffs", orderHandler.ListSellerHandoffs)
 			orderRoutes.GET("/:id", orderHandler.Detail)
 			orderRoutes.GET("/:id/chat", chatHandler.OrderConversation)
 			orderRoutes.POST("/:id/pay", orderHandler.Pay)
@@ -589,7 +597,7 @@ func New(cfg config.Config, deps Dependencies, logger *zap.Logger) *gin.Engine {
 			adminRoutes.POST("/users/:id/manual-realname", requirePerm("user:manual_realname"), adminUserHandler.ManualRealname)
 			adminRoutes.POST("/users/:id/revoke-realname", requirePerm("user:revoke_realname"), adminUserHandler.RevokeRealname)
 			adminRoutes.POST("/users/:id/wallet/adjust", requirePerm("user:wallet_adjust"), adminUserHandler.AdjustWallet)
-			adminRoutes.GET("/orders", requirePerm("order:view"), orderHandler.AdminList)
+			adminRoutes.GET("/orders", requirePerm("order:list"), orderHandler.AdminList)
 			adminRoutes.GET("/listing-orders/:id/latest", requirePerm("order:view"), orderHandler.AdminLatestByListing)
 			adminRoutes.GET("/orders/:id", requirePerm("order:view"), orderHandler.AdminDetail)
 			adminRoutes.GET("/orders/:id/handoff-records", requirePerm("order:view"), orderHandler.AdminHandoffRecords)