feat(server): 商业化支付与订单系统 + Harness 改进

- 新增商业化模块：Stripe/Binance Pay 支付、邮箱登录、订单管理
- 新增数据模型：ReportProduct, ReportEntitlement, ReportSnapshot, PaymentEvent, EmailLoginCode
- 新增 API：/api/commerce/checkout, /api/commerce/webhooks/*, /api/commerce/orders/*
- 新增管理后台：订单列表、统计图表、统一 AdminHeader 组件
- 新增中间件测试：RateLimit, Auth, CORS 共 7 个测试用例
- 新增 AGENTS.md 项目代理指令文件
- 新增 REMINDER.md 商业化功能开发规范
- 修复 JWT 解析：添加 WithValidMethods 限制 HS256
- 修复 GetPayStatus：增加用户权限校验
- 更新 .gitignore 和 README.md

server/migrations/002_commerce.sql

@@ -0,0 +1,94 @@
+ALTER TABLE orders
+    ADD COLUMN currency VARCHAR(10) NOT NULL DEFAULT 'CNY',
+    ADD COLUMN provider VARCHAR(30) NOT NULL DEFAULT '',
+    ADD COLUMN provider_amount VARCHAR(32) NOT NULL DEFAULT '',
+    ADD COLUMN provider_order_id VARCHAR(128) NOT NULL DEFAULT '',
+    ADD COLUMN provider_transaction_id VARCHAR(128) NOT NULL DEFAULT '',
+    ADD COLUMN customer_email VARCHAR(254) NOT NULL DEFAULT '',
+    ADD COLUMN report_id VARCHAR(64) NOT NULL DEFAULT '',
+    ADD COLUMN access_code VARCHAR(20) NULL,
+    ADD COLUMN checkout_url VARCHAR(1024) NOT NULL DEFAULT '';
+
+CREATE INDEX idx_orders_provider ON orders(provider);
+CREATE INDEX idx_orders_provider_order_id ON orders(provider_order_id);
+CREATE INDEX idx_orders_provider_transaction_id ON orders(provider_transaction_id);
+CREATE INDEX idx_orders_customer_email ON orders(customer_email);
+CREATE INDEX idx_orders_report_id ON orders(report_id);
+CREATE UNIQUE INDEX idx_orders_access_code ON orders(access_code);
+
+CREATE TABLE report_products (
+    id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    code VARCHAR(40) NOT NULL UNIQUE,
+    name VARCHAR(100) NOT NULL,
+    description VARCHAR(255) NOT NULL DEFAULT '',
+    stripe_amount INT NOT NULL,
+    stripe_currency VARCHAR(10) NOT NULL,
+    binance_amount VARCHAR(32) NOT NULL,
+    binance_currency VARCHAR(10) NOT NULL,
+    status TINYINT NOT NULL DEFAULT 1,
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE report_entitlements (
+    id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    user_id BIGINT UNSIGNED NOT NULL,
+    report_id VARCHAR(64) NOT NULL,
+    order_id BIGINT UNSIGNED NOT NULL UNIQUE,
+    status VARCHAR(20) NOT NULL DEFAULT 'active',
+    granted_at TIMESTAMP NOT NULL,
+    revoked_at TIMESTAMP NULL,
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    UNIQUE KEY idx_user_report (user_id, report_id),
+    INDEX idx_report_entitlements_user_id (user_id),
+    INDEX idx_report_entitlements_report_id (report_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE report_snapshots (
+    id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    user_id BIGINT UNSIGNED NOT NULL,
+    report_id VARCHAR(64) NOT NULL,
+    order_id BIGINT UNSIGNED NOT NULL UNIQUE,
+    snapshot LONGTEXT NOT NULL,
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    INDEX idx_report_snapshots_user_id (user_id),
+    INDEX idx_report_snapshots_report_id (report_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE payment_events (
+    id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    provider VARCHAR(30) NOT NULL,
+    provider_event_id VARCHAR(128) NOT NULL,
+    event_type VARCHAR(80) NOT NULL,
+    order_no VARCHAR(32) NOT NULL,
+    payload_hash VARCHAR(64) NOT NULL,
+    processed_at TIMESTAMP NOT NULL,
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE KEY idx_provider_event (provider, provider_event_id),
+    INDEX idx_payment_events_order_no (order_no)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE email_login_codes (
+    id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    email VARCHAR(254) NOT NULL,
+    code_hash VARCHAR(64) NOT NULL,
+    attempts INT NOT NULL DEFAULT 0,
+    expires_at TIMESTAMP NOT NULL,
+    used_at TIMESTAMP NULL,
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    INDEX idx_email_login_codes_email (email),
+    INDEX idx_email_login_codes_expires_at (expires_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+INSERT INTO report_products (code, name, description, stripe_amount, stripe_currency, binance_amount, binance_currency, status)
+VALUES ('bazi_full_report', '八字完整精批报告', '六大主题与十步大运完整解读', 499, 'USD', '5.00', 'USDT', 1)
+ON DUPLICATE KEY UPDATE
+    name = VALUES(name),
+    description = VALUES(description),
+    stripe_amount = VALUES(stripe_amount),
+    stripe_currency = VALUES(stripe_currency),
+    binance_amount = VALUES(binance_amount),
+    binance_currency = VALUES(binance_currency),
+    status = VALUES(status);