重构日志与可观测性体系

新增单行文本编码器与结构化 GORM 日志，统一错误记录与请求日志策略，收紧日志文件权限并修复按天切分与压缩，支付回调参数脱敏，生产强制阿里云短信，RequestID 校验防注入，日志文案中文化。

backend/internal/config/config.go

@@ -109,7 +109,7 @@ func Load() Config {
 			Level:         getEnv("LOG_LEVEL", "info"),
 			Dir:           getEnv("LOG_DIR", "logs"),
 			EnableConsole: getEnvBool("LOG_ENABLE_CONSOLE", true),
-			EnableFile:    getEnvBool("LOG_ENABLE_FILE", true),
+			EnableFile:    getEnvBool("LOG_ENABLE_FILE", false),
 			RetainDays:    getEnvInt("LOG_RETAIN_DAYS", 14),
 		},
 		RateLimit: RateLimitConfig{
@@ -123,6 +123,13 @@ func (c Config) ValidateProductionSecurity() error {
 	if !IsProductionEnv(c.AppEnv) {
 		return nil
 	}
+	if !strings.EqualFold(strings.TrimSpace(c.SMS.Provider), "aliyun") {
+		return errors.New("SMS_PROVIDER must be aliyun in production")
+	}
+	if strings.TrimSpace(c.SMS.AliyunAccessKeyID) == "" || strings.TrimSpace(c.SMS.AliyunAccessKeySecret) == "" ||
+		strings.TrimSpace(c.SMS.AliyunSignName) == "" || strings.TrimSpace(c.SMS.AliyunLoginTemplateCode) == "" {
+		return errors.New("aliyun SMS credentials, sign name, and template code are required in production")
+	}
 	if strings.TrimSpace(c.JWTSecret) == "" || isPlaceholder(c.JWTSecret) || len([]byte(c.JWTSecret)) < 32 {
 		return errors.New("JWT_SECRET must be a non-default random value of at least 32 bytes in production")
 	}