修复文件上传和下单支付流程

frontend/src/features/listings/views/ListingDetailView.vue

@@ -241,8 +241,8 @@ async function submitOrder() {
   ordering.value = true
   try {
     const order = await createOrder(listing.value.id)
-    ElMessage.success('订单已创建，请完成支付')
-    await router.push(`/orders/${order.id}`)
+    ElMessage.success('订单已创建，正在打开支付')
+    await router.push({ path: `/orders/${order.id}`, query: { pay: '1' } })
   } catch (error) {
     ElMessage.error(readError(error, '下单失败'))
   } finally {

frontend/src/features/listings/views/MobileListingDetailView.vue

@@ -231,9 +231,9 @@ async function submitOrder() {
   if (!listing.value) return
   ordering.value = true
   try {
-    await createOrder(listing.value.id)
-    showToast({ message: '订单已创建，请完成支付', icon: 'passed' })
-    await router.push(`/m/orders`)
+    const order = await createOrder(listing.value.id)
+    showToast({ message: '订单已创建，正在打开支付', icon: 'passed' })
+    await router.push({ path: `/m/orders/${order.id}`, query: { pay: '1' } })
   } catch (error) {
     showToast({ message: readError(error, '下单失败'), icon: 'cross' })
   } finally {

frontend/src/features/orders/views/MobileOrderDetailView.vue

@@ -90,6 +90,7 @@ const activeNames = ref<string[]>([])
 const showDisputePopup = ref(false)
 const showCounterPopup = ref(false)
 const showRejectPopup = ref(false)
+let autoPayHandled = false
 
 const isOwner = computed(() => order.value?.owner_id === session.userId)
 const isRenter = computed(() => order.value?.renter_id === session.userId)
@@ -139,6 +140,16 @@ async function loadOrder() {
     handoffRecords.value = await fetchHandoffRecords(String(route.params.id))
     hydrateResourceUsage()
     hydrateCounterForm()
+    if (
+      !autoPayHandled &&
+      route.query.pay === '1' &&
+      order.value?.status === 'pending_payment' &&
+      order.value?.renter_id === session.userId
+    ) {
+      autoPayHandled = true
+      void router.replace({ path: route.path })
+      void handlePay()
+    }
   } catch {
     showToast({ message: '加载订单失败', icon: 'cross' })
   } finally {

frontend/vite.config.ts

@@ -33,9 +33,28 @@ function elementPlusChunk(id: string) {
   return undefined
 }
 
+function stripVantRemoteIconFont() {
+  return {
+    name: 'strip-vant-remote-icon-font',
+    generateBundle(_options, bundle) {
+      for (const chunk of Object.values(bundle)) {
+        if (chunk.type !== 'asset' || typeof chunk.source !== 'string') continue
+        if (!chunk.fileName.endsWith('.css')) continue
+
+        // Vant 图标字体已经内联了 woff2，这里去掉远程 woff 备用地址，避免触发 CSP 外链字体拦截。
+        chunk.source = chunk.source.replace(
+          /,url\(\/\/at\.alicdn\.com\/t\/c\/font_2553510_ciljc7axaw7\.woff\?t=1705587463221\) format\("woff"\)/g,
+          ''
+        )
+      }
+    },
+  }
+}
+
 export default defineConfig({
   plugins: [
     vue(),
+    stripVantRemoteIconFont(),
     AutoImport({
       resolvers: [ElementPlusResolver()],
     }),