fix: 按评审报告止血支付漏洞并加固授权链路

废除浏览器回跳自助结算，通用 webhook 强制密钥鉴权，Waffo 支持验签与未知事件忽略；重构订单状态机/激活占座/SQLite WAL，并补备份、readyz、限流与前端导出/登录页安全修复。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/internal/model/entitlement.go

@@ -5,16 +5,16 @@ import "time"
 // CustomerEntitlement 客户权益记录（防重复购买的核心表） // Logan.Li
 type CustomerEntitlement struct {
 	ID         uint       `json:"id" gorm:"primaryKey"`
-	CustomerID uint       `json:"customer_id"`
+	CustomerID uint       `json:"customer_id" gorm:"uniqueIndex:idx_ent_cust_prod,priority:1"`
 	Customer   Customer   `json:"customer,omitempty" gorm:"foreignKey:CustomerID"`
-	ProductID  uint       `json:"product_id"`
+	ProductID  uint       `json:"product_id" gorm:"uniqueIndex:idx_ent_cust_prod,priority:2"`
 	Product    Product    `json:"product,omitempty" gorm:"foreignKey:ProductID"`
 	PlanID     uint       `json:"plan_id"`
 	Plan       Plan       `json:"plan,omitempty" gorm:"foreignKey:PlanID"`
 	LicenseID  uint       `json:"license_id"`
 	LicenseKey string     `json:"license_key" gorm:"size:100"`
-	PlanType   string     `json:"plan_type" gorm:"size:50"`                   // perpetual / monthly / yearly / lifetime
-	Status     string     `json:"status" gorm:"size:20;default:'active'"`     // active / expired / revoked
+	PlanType   string     `json:"plan_type" gorm:"size:50"`               // perpetual / monthly / yearly / lifetime
+	Status     string     `json:"status" gorm:"size:20;default:'active'"` // active / expired / revoked
 	ValidFrom  time.Time  `json:"valid_from"`
 	ValidUntil *time.Time `json:"valid_until,omitempty"` // 买断/永久为 null
 	Renewable  bool       `json:"renewable" gorm:"default:true"` // 订阅到期后是否可续费