fix: 按评审报告止血支付漏洞并加固授权链路

废除浏览器回跳自助结算，通用 webhook 强制密钥鉴权，Waffo 支持验签与未知事件忽略；重构订单状态机/激活占座/SQLite WAL，并补备份、readyz、限流与前端导出/登录页安全修复。

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/package.json

@@ -14,7 +14,7 @@
     "pinia": "^2.1.7",
     "element-plus": "^2.5.0",
     "@element-plus/icons-vue": "^2.3.1",
-    "axios": "^1.6.5",
+    "axios": "^1.7.9",
     "echarts": "^5.4.3",
     "vue-echarts": "^6.6.8",
     "dayjs": "^1.11.10"