feat(server): 商业化支付与订单系统 + Harness 改进

- 新增商业化模块：Stripe/Binance Pay 支付、邮箱登录、订单管理
- 新增数据模型：ReportProduct, ReportEntitlement, ReportSnapshot, PaymentEvent, EmailLoginCode
- 新增 API：/api/commerce/checkout, /api/commerce/webhooks/*, /api/commerce/orders/*
- 新增管理后台：订单列表、统计图表、统一 AdminHeader 组件
- 新增中间件测试：RateLimit, Auth, CORS 共 7 个测试用例
- 新增 AGENTS.md 项目代理指令文件
- 新增 REMINDER.md 商业化功能开发规范
- 修复 JWT 解析：添加 WithValidMethods 限制 HS256
- 修复 GetPayStatus：增加用户权限校验
- 更新 .gitignore 和 README.md

server/internal/middleware/middleware.go

@@ -3,6 +3,8 @@ package middleware
 import (
 	"net/http"
 	"strings"
+	"sync"
+	"time"
 
 	"github.com/gin-gonic/gin"
 	"github.com/gouki/lunar-server/internal/config"
@@ -146,10 +148,32 @@ func AdminAuth() gin.HandlerFunc {
 	}
 }
 
+var rateLimitStore = struct {
+	sync.Mutex
+	requests map[string][]time.Time
+}{requests: make(map[string][]time.Time)}
+
 // RateLimit 限流中间件
 func RateLimit() gin.HandlerFunc {
 	return func(c *gin.Context) {
-		// TODO: 实现限流
+		now := time.Now()
+		key := c.ClientIP() + "|" + c.FullPath()
+		rateLimitStore.Lock()
+		windowStart := now.Add(-time.Minute)
+		recent := rateLimitStore.requests[key][:0]
+		for _, requestTime := range rateLimitStore.requests[key] {
+			if requestTime.After(windowStart) {
+				recent = append(recent, requestTime)
+			}
+		}
+		if len(recent) >= 10 {
+			rateLimitStore.requests[key] = recent
+			rateLimitStore.Unlock()
+			c.AbortWithStatusJSON(http.StatusTooManyRequests, gin.H{"code": 429, "msg": "请求过于频繁"})
+			return
+		}
+		rateLimitStore.requests[key] = append(recent, now)
+		rateLimitStore.Unlock()
 		c.Next()
 	}
 }