feat: 节点互联双向同步——授权/计划/客户(邮箱)按业务键LWW增量同步，HTTPS+HMAC互联密钥，默认10分钟宽松节奏

backend/router/router.go

@@ -11,6 +11,7 @@ import (
 	"backend/internal/controller/plan"
 	"backend/internal/controller/product"
 	"backend/internal/controller/setting"
+	synccontroller "backend/internal/controller/sync"
 	"backend/middleware"
 	"strings"
 
@@ -93,9 +94,20 @@ func SetupRouter(db *gorm.DB, cfg *config.Config) *gin.Engine {
 	entitlementController := entitlement.NewEntitlementController(db)
 	analyticsController := analytics.NewAnalyticsController(db)
 	settingController := setting.NewSettingController(db)
+	syncController := synccontroller.NewController(db, cfg)
+
+	// 启动节点定时双向同步（宽松节奏，默认 10 分钟） // Logan.Li
+	syncController.Svc().StartSyncLoop(cfg.SyncIntervalMinutes)
 
 	api := r.Group("/api")
 	{
+		// ============ 节点互联（对端调用，HMAC 签名认证，非 JWT） ============
+		syncGroup := api.Group("/v1/sync")
+		{
+			syncGroup.POST("/handshake", middleware.RateLimit(1, 30), syncController.HandshakeIn)
+			syncGroup.POST("/exchange", middleware.RateLimit(2, 60), syncController.ExchangeIn)
+		}
+
 		// ============ 认证路由（无需 JWT） ============
 		authGroup := api.Group("/auth")
 		{
@@ -249,6 +261,17 @@ func SetupRouter(db *gorm.DB, cfg *config.Config) *gin.Engine {
 				register(system, "POST", "/waffo/test", settingController.DebugWaffo)
 			}
 
+			// 节点互联管理（双向授权同步） // Logan.Li
+			syncAdmin := protected.Group("/sync")
+			{
+				register(syncAdmin, "GET", "/peers", syncController.ListPeers)
+				register(syncAdmin, "POST", "/peers", syncController.SavePeer)
+				register(syncAdmin, "DELETE", "/peers/:id", syncController.DeletePeer)
+				register(syncAdmin, "POST", "/peers/:id/handshake", syncController.TestHandshake)
+				register(syncAdmin, "POST", "/peers/:id/sync", syncController.SyncNow)
+				register(syncAdmin, "GET", "/generate-key", syncController.GenerateKey)
+			}
+
 			// 支付调试（与 settings/waffo/test 同一 handler） // Logan.Li
 			paymentGroup := protected.Group("/payment")
 			{