AES 字段加密迁配置并兼容旧密文

移除字段加密硬编码主密钥，改为 FIELD_ENCRYPTION_KEY 注入。

保留 FIELD_ENCRYPTION_LEGACY_KEY 透明回退旧密文，新写入统一使用主密钥；生产环境校验主密钥和 legacy 密钥长度、占位符及相等关系，并统一生产环境判断口径。

补充配置与旧密文兼容回归测试。

backend/internal/modules/realname/cloudmarket_provider.go

@@ -16,14 +16,16 @@ import (
 const cloudMarketProviderName = "aliyun_cloudmarket"
 
 type CloudMarketConfig struct {
-	URL     string
-	AppCode string
+	URL       string
+	AppCode   string
+	Encryptor crypto.Encryptor
 }
 
 type CloudMarketProvider struct {
-	url     string
-	appCode string
-	client  *http.Client
+	url       string
+	appCode   string
+	client    *http.Client
+	encryptor crypto.Encryptor
 }
 
 type cloudMarketResponse struct {
@@ -42,10 +44,15 @@ func NewCloudMarketProvider(cfg CloudMarketConfig) (*CloudMarketProvider, error)
 	if _, err := url.ParseRequestURI(endpoint); err != nil {
 		return nil, fmt.Errorf("realname cloud market url invalid: %w", err)
 	}
+	encryptor := cfg.Encryptor
+	if encryptor == nil {
+		encryptor = &crypto.MockEncryptor{}
+	}
 	return &CloudMarketProvider{
-		url:     endpoint,
-		appCode: appCode,
-		client:  &http.Client{Timeout: 10 * time.Second},
+		url:       endpoint,
+		appCode:   appCode,
+		client:    &http.Client{Timeout: 10 * time.Second},
+		encryptor: encryptor,
 	}, nil
 }
 
@@ -108,11 +115,11 @@ func (p *CloudMarketProvider) Start(ctx context.Context, req StartRequest) (Prov
 	}
 
 	// 加密完整信息
-	encryptedName, err := crypto.Encrypt(req.Name)
+	encryptedName, err := p.encryptor.Encrypt(req.Name)
 	if err != nil {
 		return ProviderResult{}, err
 	}
-	encryptedIDNo, err := crypto.Encrypt(req.IDNo)
+	encryptedIDNo, err := p.encryptor.Encrypt(req.IDNo)
 	if err != nil {
 		return ProviderResult{}, err
 	}