feat(server): 商业化支付与订单系统 + Harness 改进

- 新增商业化模块：Stripe/Binance Pay 支付、邮箱登录、订单管理
- 新增数据模型：ReportProduct, ReportEntitlement, ReportSnapshot, PaymentEvent, EmailLoginCode
- 新增 API：/api/commerce/checkout, /api/commerce/webhooks/*, /api/commerce/orders/*
- 新增管理后台：订单列表、统计图表、统一 AdminHeader 组件
- 新增中间件测试：RateLimit, Auth, CORS 共 7 个测试用例
- 新增 AGENTS.md 项目代理指令文件
- 新增 REMINDER.md 商业化功能开发规范
- 修复 JWT 解析：添加 WithValidMethods 限制 HS256
- 修复 GetPayStatus：增加用户权限校验
- 更新 .gitignore 和 README.md

server/internal/config/config.go

@@ -6,13 +6,17 @@ import (
 )
 
 type Config struct {
-	Server   ServerConfig
-	Database DatabaseConfig
-	Redis    RedisConfig
-	JWT      JWTConfig
-	Wechat   WechatConfig
-	Admin    AdminConfig
-	Wiki     WikiConfig
+	Server     ServerConfig
+	Database   DatabaseConfig
+	Redis      RedisConfig
+	JWT        JWTConfig
+	Wechat     WechatConfig
+	Stripe     StripeConfig
+	BinancePay BinancePayConfig
+	Postmark   PostmarkConfig
+	Commerce   CommerceConfig
+	Admin      AdminConfig
+	Wiki       WikiConfig
 }
 
 type ServerConfig struct {
@@ -48,6 +52,30 @@ type WechatConfig struct {
 	MchID     string
 }
 
+type StripeConfig struct {
+	SecretKey     string
+	WebhookSecret string
+	APIBaseURL    string
+}
+
+type BinancePayConfig struct {
+	APIKey           string
+	SecretKey        string
+	APIBaseURL       string
+	WebhookPublicKey string
+}
+
+type PostmarkConfig struct {
+	ServerToken string
+	FromEmail   string
+	APIBaseURL  string
+}
+
+type CommerceConfig struct {
+	PublicBaseURL string
+	WebAppURL     string
+}
+
 // AdminConfig 管理后台配置
 type AdminConfig struct {
 	// Password 管理员登录密码；为空时禁用后台登录
@@ -92,6 +120,26 @@ func Load() *Config {
 			PayKey:    getEnv("WECHAT_PAY_APIKEY", ""),
 			MchID:     getEnv("WECHAT_PAY_MCHID", ""),
 		},
+		Stripe: StripeConfig{
+			SecretKey:     getEnv("STRIPE_SECRET_KEY", ""),
+			WebhookSecret: getEnv("STRIPE_WEBHOOK_SECRET", ""),
+			APIBaseURL:    getEnv("STRIPE_API_BASE_URL", "https://api.stripe.com"),
+		},
+		BinancePay: BinancePayConfig{
+			APIKey:           getEnv("BINANCE_PAY_API_KEY", ""),
+			SecretKey:        getEnv("BINANCE_PAY_SECRET_KEY", ""),
+			APIBaseURL:       getEnv("BINANCE_PAY_API_BASE_URL", "https://bpay.binanceapi.com"),
+			WebhookPublicKey: getEnv("BINANCE_PAY_WEBHOOK_PUBLIC_KEY", ""),
+		},
+		Postmark: PostmarkConfig{
+			ServerToken: getEnv("POSTMARK_SERVER_TOKEN", ""),
+			FromEmail:   getEnv("POSTMARK_FROM_EMAIL", ""),
+			APIBaseURL:  getEnv("POSTMARK_API_BASE_URL", "https://api.postmarkapp.com"),
+		},
+		Commerce: CommerceConfig{
+			PublicBaseURL: getEnv("PUBLIC_BASE_URL", "http://localhost:8080"),
+			WebAppURL:     getEnv("WEB_APP_URL", "http://localhost:4260"),
+		},
 		Admin: AdminConfig{
 			Password: getEnv("ADMIN_PASSWORD", ""),
 		},

server/internal/config/database.go

@@ -5,9 +5,9 @@ import (
 	"log"
 
 	"github.com/glebarez/sqlite"
+	"github.com/gouki/lunar-server/internal/model"
 	"gorm.io/driver/mysql"
 	"gorm.io/gorm"
-	"github.com/gouki/lunar-server/internal/model"
 )
 
 var DB *gorm.DB
@@ -56,6 +56,12 @@ func autoMigrate() error {
 		&model.BirthProfile{},
 		&model.Order{},
 		&model.OrderItem{},
+		&model.ReportProduct{},
+		&model.ReportEntitlement{},
+		&model.ReportSnapshot{},
+		&model.PaymentEvent{},
+		&model.EmailLoginCode{},
+		&model.BaziChartRecord{},
 		&model.WishTree{},
 		&model.Wish{},
 		&model.WishProduct{},
@@ -78,6 +84,14 @@ func autoMigrate() error {
 
 // seedDefaultData 初始化默认数据
 func seedDefaultData() error {
+	reportProduct := model.ReportProduct{
+		Code: "bazi_full_report", Name: "八字完整精批报告", Description: "六大主题与十步大运完整解读",
+		StripeAmount: 499, StripeCurrency: "USD", BinanceAmount: "5.00", BinanceCurrency: "USDT", Status: 1,
+	}
+	if err := DB.Where("code = ?", reportProduct.Code).FirstOrCreate(&reportProduct).Error; err != nil {
+		return err
+	}
+
 	// 补充已有许愿树的背景图（新增字段后老数据为空）
 	if err := DB.Model(&model.WishTree{}).
 		Where("image = '' OR image IS NULL").