fix: 按评审报告止血支付漏洞并加固授权链路

废除浏览器回跳自助结算，通用 webhook 强制密钥鉴权，Waffo 支持验签与未知事件忽略；重构订单状态机/激活占座/SQLite WAL，并补备份、readyz、限流与前端导出/登录页安全修复。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/database/seed.go

@@ -239,37 +239,26 @@ func ensureOpsXShellPlanPricing(db *gorm.DB) error {
 	for _, u := range updates {
 		var plan model.Plan
 		err := db.Where("product_id = ? AND plan_type = ?", product.ID, u.planType).First(&plan).Error
-		if err != nil {
-			plan = model.Plan{
-				ProductID:  product.ID,
-				Name:       u.name,
-				PlanType:   u.planType,
-				Price:      u.price,
-				Currency:   u.currency,
-				Duration:   u.duration,
-				MaxDevices: u.maxDevices,
-				Features:   u.features,
-				SortOrder:  u.sortOrder,
-				Status:     1,
-			}
-			if err := db.Create(&plan).Error; err != nil {
-				return err
-			}
-			continue
+		if err == nil {
+			continue // 已存在：尊重管理员运行时修改，不再覆盖 // Logan.Li
 		}
-		plan.Name = u.name
-		plan.Price = u.price
-		plan.Currency = u.currency
-		plan.Duration = u.duration
-		plan.MaxDevices = u.maxDevices
-		plan.Features = u.features
-		plan.SortOrder = u.sortOrder
-		plan.Status = 1
-		if err := db.Save(&plan).Error; err != nil {
+		plan = model.Plan{
+			ProductID:  product.ID,
+			Name:       u.name,
+			PlanType:   u.planType,
+			Price:      u.price,
+			Currency:   u.currency,
+			Duration:   u.duration,
+			MaxDevices: u.maxDevices,
+			Features:   u.features,
+			SortOrder:  u.sortOrder,
+			Status:     1,
+		}
+		if err := db.Create(&plan).Error; err != nil {
 			return err
 		}
 	}
-	log.Printf("[初始化] OpsXShell 套餐已同步: 包年¥99/2台, 永久¥199/5台, 体验180天/1台")
+	log.Printf("[初始化] OpsXShell 套餐已确保存在（仅新建，不覆盖已有价格）")
 	return nil
 }
 
@@ -288,21 +277,13 @@ func ensureWaffoPaymentGateway(db *gorm.DB) error {
 		if err := db.Create(&gw).Error; err != nil {
 			return err
 		}
-	} else {
-		existing.Enabled = true
-		existing.SandboxMode = true
-		existing.Currency = "CNY"
-		existing.Priority = 0
-		if err := db.Save(&existing).Error; err != nil {
-			return err
-		}
+		log.Println("[初始化] 已创建 Waffo 支付网关（默认沙箱，可在后台改 live）")
 	}
-	// Lower priority for other enabled gateways (ASC pick prefers Waffo).
+	// 已存在则不覆盖 Enabled/SandboxMode，尊重管理员配置 // Logan.Li
 	if err := db.Model(&model.PaymentGatewayConfig{}).
 		Where("gateway <> ? AND enabled = ?", "waffo", true).
 		Update("priority", 100).Error; err != nil {
 		return err
 	}
-	log.Println("[初始化] 支付网关已优先 Waffo（包年/永久均为 onetime）")
 	return nil
 }