refactor: 错误消息脱敏 + 后端 CI

- 新增 utils.InternalMsg:内部错误详情只进服务端日志,对外统一脱敏
  消息,不再向客户端泄露 GORM/SQL 实现细节;九个 controller 的
  err.Error() 出口全部切换
- 新增 .github/workflows/ci.yml:go build/vet/test(backend,go 1.25)

backend/internal/controller/entitlement/entitlement_controller.go

@@ -54,7 +54,7 @@ func (ctrl *EntitlementController) Get(c *gin.Context) {
 func (ctrl *EntitlementController) Revoke(c *gin.Context) {
 	id, _ := strconv.ParseUint(c.Param("id"), 10, 32)
 	if err := ctrl.svc.Revoke(uint(id)); err != nil {
-		c.JSON(http.StatusOK, gin.H{"code": 1, "message": err.Error()})
+		c.JSON(http.StatusOK, gin.H{"code": 1, "message": utils.InternalMsg(err)})
 		return
 	}
 	utils.LogAction(ctrl.db, c, "revoke", "entitlement", uint(id), "", "", "", "吊销客户权益")
@@ -73,7 +73,7 @@ func (ctrl *EntitlementController) Renew(c *gin.Context) {
 	}
 	ent, err := ctrl.svc.Renew(uint(id), req.PlanID)
 	if err != nil {
-		c.JSON(http.StatusOK, gin.H{"code": 1, "message": err.Error()})
+		c.JSON(http.StatusOK, gin.H{"code": 1, "message": utils.InternalMsg(err)})
 		return
 	}
 	utils.LogAction(ctrl.db, c, "renew", "entitlement", ent.ID, "", "", "", "续费客户权益")
@@ -89,7 +89,7 @@ func (ctrl *EntitlementController) GetByEmail(c *gin.Context) {
 	}
 	entitlements, err := ctrl.svc.GetByEmail(email)
 	if err != nil {
-		c.JSON(http.StatusOK, gin.H{"code": 1, "message": err.Error()})
+		c.JSON(http.StatusOK, gin.H{"code": 1, "message": utils.InternalMsg(err)})
 		return
 	}
 	c.JSON(http.StatusOK, gin.H{"code": 0, "data": entitlements})