fix: 按评审报告止血支付漏洞并加固授权链路

废除浏览器回跳自助结算，通用 webhook 强制密钥鉴权，Waffo 支持验签与未知事件忽略；重构订单状态机/激活占座/SQLite WAL，并补备份、readyz、限流与前端导出/登录页安全修复。

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/views/Login.vue

@@ -41,8 +41,6 @@
           </el-button>
         </el-form-item>
       </el-form>
-
-      <div class="login-tip">默认账号：admin / admin</div>
     </div>
   </div>
 </template>
@@ -60,8 +58,8 @@ const userStore = useUserStore()
 const loginFormRef = ref(null)
 const loading = ref(false)
 const loginForm = reactive({
-  username: 'admin',
-  password: 'admin',
+  username: '',
+  password: '',
 })
 const loginRules = {
   username: [{ required: true, message: '请输入用户名', trigger: 'blur' }],
@@ -117,10 +115,4 @@ async function handleLogin() {
   color: #909399;
   font-size: 14px;
 }
-.login-tip {
-  text-align: center;
-  color: #c0c4cc;
-  font-size: 12px;
-  margin-top: 16px;
-}
 </style>