fix: 按评审报告止血支付漏洞并加固授权链路

废除浏览器回跳自助结算，通用 webhook 强制密钥鉴权，Waffo 支持验签与未知事件忽略；重构订单状态机/激活占座/SQLite WAL，并补备份、readyz、限流与前端导出/登录页安全修复。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/internal/service/entitlement/entitlement_service.go

@@ -5,6 +5,7 @@ import (
 	"backend/internal/model"
 	"backend/utils"
 	"errors"
+	"strings"
 	"time"
 
 	"gorm.io/gorm"
@@ -134,7 +135,7 @@ func (s *EntitlementService) Renew(id, planID uint) (*dto.EntitlementResponse, e
 	return &resp, nil
 }
 
-// GetByEmail 按邮箱查询客户权益（客户端接口） // Logan.Li
+// GetByEmail 按邮箱查询客户权益（客户端接口；不回传完整 License Key） // Logan.Li
 func (s *EntitlementService) GetByEmail(email string) ([]dto.EntitlementResponse, error) {
 	var customer model.Customer
 	if err := s.db.Where("email = ?", email).First(&customer).Error; err != nil {
@@ -148,11 +149,25 @@ func (s *EntitlementService) GetByEmail(email string) ([]dto.EntitlementResponse
 
 	results := make([]dto.EntitlementResponse, 0, len(entitlements))
 	for _, e := range entitlements {
-		results = append(results, s.toResponse(e))
+		resp := s.toResponse(e)
+		resp.LicenseKey = maskLicenseKey(resp.LicenseKey)
+		results = append(results, resp)
 	}
 	return results, nil
 }
 
+// maskLicenseKey 脱敏展示，避免公开接口泄露完整密钥 // Logan.Li
+func maskLicenseKey(key string) string {
+	key = strings.TrimSpace(key)
+	if len(key) <= 8 {
+		if key == "" {
+			return ""
+		}
+		return "****"
+	}
+	return key[:4] + "****" + key[len(key)-4:]
+}
+
 // toResponse 模型转响应 DTO // Logan.Li
 func (s *EntitlementService) toResponse(e model.CustomerEntitlement) dto.EntitlementResponse {
 	resp := dto.EntitlementResponse{