refactor: 错误消息脱敏 + 后端 CI

- 新增 utils.InternalMsg:内部错误详情只进服务端日志,对外统一脱敏
  消息,不再向客户端泄露 GORM/SQL 实现细节;九个 controller 的
  err.Error() 出口全部切换
- 新增 .github/workflows/ci.yml:go build/vet/test(backend,go 1.25)

backend/internal/controller/customer/customer_controller.go

@@ -72,7 +72,7 @@ func (ctrl *CustomerController) Create(c *gin.Context) {
 	}
 	customer, err := ctrl.svc.Create(req)
 	if err != nil {
-		c.JSON(http.StatusOK, gin.H{"code": 1, "message": err.Error()})
+		c.JSON(http.StatusOK, gin.H{"code": 1, "message": utils.InternalMsg(err)})
 		return
 	}
 	utils.LogAction(ctrl.db, c, "create", "customer", customer.ID, customer.Name, "", "", "创建客户")
@@ -89,7 +89,7 @@ func (ctrl *CustomerController) Update(c *gin.Context) {
 	}
 	customer, err := ctrl.svc.Update(uint(id), req)
 	if err != nil {
-		c.JSON(http.StatusOK, gin.H{"code": 1, "message": err.Error()})
+		c.JSON(http.StatusOK, gin.H{"code": 1, "message": utils.InternalMsg(err)})
 		return
 	}
 	utils.LogAction(ctrl.db, c, "update", "customer", customer.ID, customer.Name, "", "", "更新客户")
@@ -100,7 +100,7 @@ func (ctrl *CustomerController) Update(c *gin.Context) {
 func (ctrl *CustomerController) Delete(c *gin.Context) {
 	id, _ := strconv.ParseUint(c.Param("id"), 10, 32)
 	if err := ctrl.svc.Delete(uint(id)); err != nil {
-		c.JSON(http.StatusOK, gin.H{"code": 1, "message": err.Error()})
+		c.JSON(http.StatusOK, gin.H{"code": 1, "message": utils.InternalMsg(err)})
 		return
 	}
 	utils.LogAction(ctrl.db, c, "delete", "customer", uint(id), "", "", "", "删除客户")
@@ -115,7 +115,7 @@ func (ctrl *CustomerController) UpdateStatus(c *gin.Context) {
 	}
 	c.ShouldBindJSON(&req)
 	if err := ctrl.svc.UpdateStatus(uint(id), req.Status); err != nil {
-		c.JSON(http.StatusOK, gin.H{"code": 1, "message": err.Error()})
+		c.JSON(http.StatusOK, gin.H{"code": 1, "message": utils.InternalMsg(err)})
 		return
 	}
 	utils.LogAction(ctrl.db, c, "update_status", "customer", uint(id), "", "", "", "切换客户状态")
@@ -133,7 +133,7 @@ func (ctrl *CustomerController) BatchDelete(c *gin.Context) {
 	}
 	result, err := ctrl.svc.BatchDelete(req.IDs)
 	if err != nil {
-		c.JSON(http.StatusOK, gin.H{"code": 1, "message": err.Error()})
+		c.JSON(http.StatusOK, gin.H{"code": 1, "message": utils.InternalMsg(err)})
 		return
 	}
 	utils.LogAction(ctrl.db, c, "batch_delete", "customer", 0, "", "", "",