AES 字段加密迁配置并兼容旧密文

移除字段加密硬编码主密钥，改为 FIELD_ENCRYPTION_KEY 注入。

保留 FIELD_ENCRYPTION_LEGACY_KEY 透明回退旧密文，新写入统一使用主密钥；生产环境校验主密钥和 legacy 密钥长度、占位符及相等关系，并统一生产环境判断口径。

补充配置与旧密文兼容回归测试。

backend/internal/modules/realname/cloudmarket_provider.go

@@ -16,14 +16,16 @@ import (
 const cloudMarketProviderName = "aliyun_cloudmarket"
 
 type CloudMarketConfig struct {
-	URL     string
-	AppCode string
+	URL       string
+	AppCode   string
+	Encryptor crypto.Encryptor
 }
 
 type CloudMarketProvider struct {
-	url     string
-	appCode string
-	client  *http.Client
+	url       string
+	appCode   string
+	client    *http.Client
+	encryptor crypto.Encryptor
 }
 
 type cloudMarketResponse struct {
@@ -42,10 +44,15 @@ func NewCloudMarketProvider(cfg CloudMarketConfig) (*CloudMarketProvider, error)
 	if _, err := url.ParseRequestURI(endpoint); err != nil {
 		return nil, fmt.Errorf("realname cloud market url invalid: %w", err)
 	}
+	encryptor := cfg.Encryptor
+	if encryptor == nil {
+		encryptor = &crypto.MockEncryptor{}
+	}
 	return &CloudMarketProvider{
-		url:     endpoint,
-		appCode: appCode,
-		client:  &http.Client{Timeout: 10 * time.Second},
+		url:       endpoint,
+		appCode:   appCode,
+		client:    &http.Client{Timeout: 10 * time.Second},
+		encryptor: encryptor,
 	}, nil
 }
 
@@ -108,11 +115,11 @@ func (p *CloudMarketProvider) Start(ctx context.Context, req StartRequest) (Prov
 	}
 
 	// 加密完整信息
-	encryptedName, err := crypto.Encrypt(req.Name)
+	encryptedName, err := p.encryptor.Encrypt(req.Name)
 	if err != nil {
 		return ProviderResult{}, err
 	}
-	encryptedIDNo, err := crypto.Encrypt(req.IDNo)
+	encryptedIDNo, err := p.encryptor.Encrypt(req.IDNo)
 	if err != nil {
 		return ProviderResult{}, err
 	}

backend/internal/modules/realname/cloudmarket_provider_test.go

@@ -5,6 +5,8 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+
+	"hfb_sys/backend/pkg/crypto"
 )
 
 func TestCloudMarketProviderStartVerified(t *testing.T) {
@@ -27,7 +29,8 @@ func TestCloudMarketProviderStartVerified(t *testing.T) {
 
 	provider, err := NewCloudMarketProvider(CloudMarketConfig{
 		URL:     server.URL,
-		AppCode: "test-code",
+		AppCode:   "test-code",
+		Encryptor: &crypto.MockEncryptor{},
 	})
 	if err != nil {
 		t.Fatalf("创建 Provider 失败：%v", err)
@@ -60,7 +63,8 @@ func TestCloudMarketProviderStartRejected(t *testing.T) {
 
 	provider, err := NewCloudMarketProvider(CloudMarketConfig{
 		URL:     server.URL,
-		AppCode: "test-code",
+		AppCode:   "test-code",
+		Encryptor: &crypto.MockEncryptor{},
 	})
 	if err != nil {
 		t.Fatalf("创建 Provider 失败：%v", err)
@@ -90,7 +94,8 @@ func TestCloudMarketProviderStartRateLimited(t *testing.T) {
 
 	provider, err := NewCloudMarketProvider(CloudMarketConfig{
 		URL:     server.URL,
-		AppCode: "test-code",
+		AppCode:   "test-code",
+		Encryptor: &crypto.MockEncryptor{},
 	})
 	if err != nil {
 		t.Fatalf("创建 Provider 失败：%v", err)

backend/internal/modules/realname/provider.go

@@ -33,10 +33,15 @@ type ProviderResult struct {
 	FailReason      string
 }
 
-type MockProvider struct{}
+type MockProvider struct {
+	encryptor crypto.Encryptor
+}
 
-func NewMockProvider() *MockProvider {
-	return &MockProvider{}
+func NewMockProvider(encryptor crypto.Encryptor) *MockProvider {
+	if encryptor == nil {
+		encryptor = &crypto.MockEncryptor{}
+	}
+	return &MockProvider{encryptor: encryptor}
 }
 
 func (p *MockProvider) Name() string {
@@ -53,11 +58,11 @@ func (p *MockProvider) Start(_ context.Context, req StartRequest) (ProviderResul
 	}
 
 	// 加密完整信息
-	encryptedName, err := crypto.Encrypt(req.Name)
+	encryptedName, err := p.encryptor.Encrypt(req.Name)
 	if err != nil {
 		return ProviderResult{}, err
 	}
-	encryptedIDNo, err := crypto.Encrypt(req.IDNo)
+	encryptedIDNo, err := p.encryptor.Encrypt(req.IDNo)
 	if err != nil {
 		return ProviderResult{}, err
 	}