Merge origin/main into feat/a11y-liveness-heartbeat(并解决 alembic 双 head)

合并 main 引入 cps_wx_user / 穿山甲配置后台化 / 注销账号校验 / 文档重构 等。
合并产生 alembic 双 head(main 的 cps_wx_user + 本分支 device_kill_alert_pending)→ 新增合并节点 3a8fa058789c 收敛为单 head, alembic upgrade head 恢复正常(修 run.sh 的 Multiple head revisions)。
顺手修 heartbeat_monitor_worker 掉线告警日志 🔴 emoji 在 Windows GBK 控制台 UnicodeEncodeError(非致命刷屏)。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/api/internal/app_version.py

@@ -0,0 +1,58 @@
+"""最新 App 版本写入端点(发布流程 → app-server)。
+
+发车流程出 APK 后,把版本号 / 下载链接 / sha256 等 POST 到这里,落 app_config(key=latest_app_version)。
+客户端再 GET /api/v1/platform/app-version 读取做 OTA 检查更新。**不是给客户端的接口**:
+不走用户 JWT,靠 server 间共享密钥头 `X-Internal-Secret` 校验(== settings.INTERNAL_API_SECRET)。
+密钥未配置(默认空)时直接 503,避免裸奔的写端点。也是应急改版本信息(紧急下线/改 apk_url)的入口。
+"""
+from __future__ import annotations
+
+import hmac
+import logging
+from typing import Annotated
+
+from fastapi import APIRouter, Header, HTTPException, status
+
+from app.api.deps import DbSession
+from app.core.config import settings
+from app.repositories import app_config
+from app.schemas.platform import AppVersionOut, AppVersionWriteIn
+
+logger = logging.getLogger("shagua.internal.app_version")
+
+router = APIRouter(prefix="/internal", tags=["internal"])
+
+
+def _check_secret(x_internal_secret: str | None) -> None:
+    """共享密钥校验。未配置 → 503(挡住裸奔写端点);不匹配 → 401(常量时间比较)。"""
+    configured = settings.INTERNAL_API_SECRET
+    if not configured:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="internal api not configured",
+        )
+    if not x_internal_secret or not hmac.compare_digest(x_internal_secret, configured):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="invalid internal secret",
+        )
+
+
+@router.post(
+    "/app-version",
+    response_model=AppVersionOut,
+    summary="写最新 App 版本(发布流程→app-server,落 app_config)",
+)
+def write_app_version(
+    payload: AppVersionWriteIn,
+    db: DbSession,
+    x_internal_secret: Annotated[str | None, Header()] = None,
+) -> AppVersionOut:
+    _check_secret(x_internal_secret)
+    data = payload.model_dump()
+    app_config.set_app_version(db, data)
+    logger.info(
+        "app_version set code=%d name=%s url=%s",
+        payload.latest_version_code, payload.latest_version_name, payload.apk_url,
+    )
+    return AppVersionOut(**data)

app/api/v1/ad.py

@@ -24,6 +24,7 @@ from app.repositories import ad_ecpm as crud_ecpm
 from app.repositories import ad_feed_reward as crud_feed
 from app.repositories import ad_reward as crud_ad
 from app.repositories import ad_watch as crud_watch
+from app.repositories import app_config
 from app.repositories import signin as crud_signin
 from app.schemas.ad import (
     AdRewardStatusOut,
@@ -80,14 +81,22 @@ def pangle_callback(request: Request, db: DbSession) -> PangleCallbackOut:
     验签失败 403(留给真请求重试);参数缺/坏或 user 不存在 → is_verify=false + reason(不发,不重试)。
     granted / capped → is_verify=true + reason=0。
     """
-    if not settings.pangle_callback_configured:
+    if not settings.PANGLE_CALLBACK_ENABLED:
         raise HTTPException(
             status_code=status.HTTP_503_SERVICE_UNAVAILABLE, detail="pangle callback not configured"
         )
 
     params = dict(request.query_params)
 
-    if not pangle.verify_callback_sign(params, settings.PANGLE_REWARD_SECRET):
+    # 验签密钥:admin 后台配的 reward_mkey 优先,.env 的 PANGLE_REWARD_SECRET* 兜底(兼容/过渡)。
+    # 换激励位时后台同步换 mkey 即可,无需改 .env。两者都空才视为未配置。
+    ad_mkey = app_config.get_ad_config(db).get("reward_mkey") or ""
+    secrets = ([ad_mkey] if ad_mkey else []) + settings.pangle_reward_secrets
+    if not secrets:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE, detail="pangle callback not configured"
+        )
+    if not pangle.verify_callback_sign_any(params, secrets):
         logger.warning("pangle callback bad sign trans_id=%s", params.get("trans_id"))
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="bad sign")
 

app/api/v1/compare.py

@@ -116,3 +116,11 @@ async def intent_precoupon_step(request: Request) -> dict[str, Any]:
 @router.post("/price/step", summary="外卖比价 Phase 2 步进 (透传到 pricebot)")
 async def price_step(request: Request) -> dict[str, Any]:
     return await _passthrough(request, "/api/price/step")
+
+
+@router.post("/trace/finalize", summary="比价 trace 收尾上云 (透传到 pricebot, 终止/未识别拿 trace_url)")
+async def trace_finalize(request: Request) -> dict[str, Any]:
+    # 用户终止 / Phase1 未识别没走到 done 帧, pricebot 没上云也没回传 trace_url。客户端收尾时
+    # 打这个, _passthrough 按 trace_id 一致性 hash 落到处理这条 trace 的同一 pricebot 进程
+    # (dir_cache 在那, 才能算对 trace 目录), 由后者打包上云返回 {trace_url}。
+    return await _passthrough(request, "/api/trace/finalize")

app/api/v1/compare_record.py

@@ -15,10 +15,13 @@ from __future__ import annotations
 
 import logging
 
-from fastapi import APIRouter, HTTPException, Query, status
+from fastapi import APIRouter, BackgroundTasks, HTTPException, Query, status
 
 from app.api.deps import CurrentUser, DbSession
+from app.db.session import SessionLocal
+from app.models.comparison import ComparisonRecord
 from app.repositories import comparison as crud_compare
+from app.services.pricebot_llm_calls import fetch_llm_calls
 from app.schemas.compare_record import (
     CompareStatsOut,
     ComparisonRecordCreatedOut,
@@ -39,11 +42,18 @@ router = APIRouter(prefix="/api/v1/compare", tags=["compare-record"])
     summary="上报一次比价结果(幂等)",
 )
 def report_record(
-    payload: ComparisonRecordIn, user: CurrentUser, db: DbSession
+    payload: ComparisonRecordIn,
+    user: CurrentUser,
+    db: DbSession,
+    background_tasks: BackgroundTasks,
 ) -> ComparisonRecordCreatedOut:
     rec = crud_compare.upsert_record(db, user_id=user.id, payload=payload)
+    # LLM 调用明细异步回填:同机拉 pricebot llm_calls 最长 5s 且是 best-effort,放后台
+    # 任务做,不阻塞上报响应(顺带给 pricebot 落盘留足余量)。upsert 已 commit,后台用
+    # 独立 session 按 record id 回填 llm_calls + 派生 llm_call_count/retry_count。
+    background_tasks.add_task(_backfill_llm_calls, rec.id, rec.trace_id)
     logger.info(
-        "compare record user=%s trace=%s biz=%s status=%s saved=%s",
+        "compare record user=%s trace=%s biz=%s status=%s saved=%s (llm_calls backfill queued)",
         user.id,
         rec.trace_id,
         rec.business_type,
@@ -53,6 +63,28 @@ def report_record(
     return ComparisonRecordCreatedOut(id=rec.id)
 
 
+def _backfill_llm_calls(record_id: int, trace_id: str) -> None:
+    """后台回填本次比价的 LLM 调用明细 + 派生 llm_call_count/retry_count。
+    独立 DB session(请求 session 此时已关);拉取/写库失败只 log,绝不影响已落库的上报。"""
+    calls = fetch_llm_calls(trace_id)
+    if not calls:
+        return
+    db = SessionLocal()
+    try:
+        rec = db.get(ComparisonRecord, record_id)
+        if rec is None:
+            return
+        rec.llm_calls = calls
+        rec.llm_call_count = len(calls)
+        rec.retry_count = sum(1 for c in calls if c.get("error"))
+        db.commit()
+        logger.info("backfill llm_calls trace=%s n=%d", trace_id, len(calls))
+    except Exception as e:  # noqa: BLE001 best-effort
+        logger.warning("backfill llm_calls failed trace=%s: %s", trace_id, e)
+    finally:
+        db.close()
+
+
 @router.get(
     "/stats",
     response_model=CompareStatsOut,
@@ -73,13 +105,20 @@ def list_records(
     db: DbSession,
     limit: int = Query(20, ge=1, le=100),
     cursor: int | None = Query(None, description="上一页末条 id"),
+    include_trace: bool = Query(
+        False,
+        description="客户端开了本机 agent 调试模式时带 true,放行本人记录的 trace_url",
+    ),
 ) -> ComparisonRecordPage:
     items, next_cursor = crud_compare.list_records(
         db, user.id, limit=limit, cursor=cursor
     )
     outs = [ComparisonRecordOut.model_validate(it) for it in items]
-    # 权限闸:未开 debug_trace_enabled 的用户不下发 trace_url(列表页「复制调试链接」靠它)
-    if not user.debug_trace_enabled:
+    # 权限闸:未开 debug_trace_enabled 的用户不下发 trace_url(列表页「复制调试链接」靠它)。
+    # include_trace=true 例外:客户端开了本机 agent 调试模式时带上,放行**本人记录**的 trace_url
+    # ——list_records 只查 user.id 自己的记录,给本人看自己的调试链接无越权,与实时结果页
+    # CompResultScreen「debug 权限 OR 本机 agent 调试」同口径(领导 2026-06-12 拍板)。
+    if not (user.debug_trace_enabled or include_trace):
         for o in outs:
             o.trace_url = None
     return ComparisonRecordPage(items=outs, next_cursor=next_cursor)

app/api/v1/cps_redirect.py

@@ -1,21 +1,48 @@
-"""CPS 群发短链跳转:用户点 /c/{code} → 记一条点击 → 302 跳美团。
+"""CPS 群发短链落地:用户点 /c/{code} → 记点击 → 按平台 302 跳 或 返回淘宝落地页。
 
-公网、无鉴权(群里任何人点都要能跳)。记点击失败绝不影响跳转(用户体验优先)。
+公网无鉴权(群里任何人点都要能跳/能领)。记点击失败绝不影响用户。
+- 美团/京东:记 visit + 302 跳 target(美团短链 / 京东链接)
+- 淘宝:记 visit + 返回 H5 落地页(整段淘口令复制按钮);点"复制口令"→ POST /c/{code}/copy 记 copy
 """
 from __future__ import annotations
 
+import html
+import json
+import logging
+
 from fastapi import APIRouter, Depends, Request
-from fastapi.responses import RedirectResponse
+from fastapi.responses import HTMLResponse, PlainTextResponse, RedirectResponse
 from sqlalchemy.orm import Session
 
+from app.core import media
+from app.core.config import settings
 from app.db.session import get_db
+from app.integrations import wx_oauth
+from app.models.cps_activity import CpsActivity
+from app.models.cps_link import CpsLink
 from app.repositories import cps_link as cps_link_repo
+from app.repositories import cps_wx_user as cps_wx_user_repo
+
+logger = logging.getLogger("shagua.cps_redirect")
 
 router = APIRouter(tags=["cps-redirect"])
 
-# code 不存在/失效时的兜底落地(避免用户看到报错)
+# code 不存在/失效时的兜底落地
 _FALLBACK_URL = "https://www.meituan.com/"
 
+# 淘宝活动未设图时的兜底主视觉(存量已回填,基本只在老 link/异常时触发)
+_DEFAULT_TAOBAO_IMAGE = "/media/taobao_landing.jpg"
+
+# 微信网页授权拿到的用户标识 cookie(种在 coupon 域,30 天免重复授权)
+_WX_OPENID_COOKIE = "wx_openid"
+_WX_UINFO_COOKIE = "wx_uinfo"  # "1" = 已拿过昵称头像(userinfo),点领券不再跳授权
+_COOKIE_MAX_AGE = 30 * 86400
+
+
+def _is_wechat(request: Request) -> bool:
+    """是否微信内置浏览器(网页授权只在微信内有意义,外部浏览器不跳授权)。"""
+    return "micromessenger" in (request.headers.get("user-agent", "").lower())
+
 
 def _client_ip(request: Request) -> str | None:
     xff = request.headers.get("x-forwarded-for")
@@ -24,16 +51,158 @@ def _client_ip(request: Request) -> str | None:
     return request.client.host if request.client else None
 
 
-@router.get("/c/{code}", summary="群发短链跳转(记点击 + 302)")
-def cps_redirect(code: str, request: Request, db: Session = Depends(get_db)):
-    link = cps_link_repo.get_by_code(db, code)
-    if link is None:
-        return RedirectResponse(_FALLBACK_URL, status_code=302)
+def _record(
+    db: Session, link: CpsLink, request: Request, event_type: str, openid: str | None = None
+) -> None:
     try:
         cps_link_repo.record_click(
             db, link=link, ip=_client_ip(request),
-            ua=request.headers.get("user-agent"),
+            ua=request.headers.get("user-agent"), event_type=event_type, openid=openid,
         )
     except Exception:
-        pass  # 记点击失败不阻断跳转
+        pass  # 记点击失败不阻断
+
+
+@router.get("/MP_verify_F7wnRQ7xPbhVOWC8.txt", include_in_schema=False)
+def wx_mp_domain_verify() -> PlainTextResponse:
+    """微信「网页授权域名」归属校验文件。coupon.shaguabijia.com 全反代 app-server,
+    微信请求 coupon.shaguabijia.com/MP_verify_xxx.txt 验证域名归属;内容=文件名核心串。
+    放域名根目录(本端点即根路径),为微信网页授权(拿 openid)接入做准备。"""
+    return PlainTextResponse("F7wnRQ7xPbhVOWC8")
+
+
+@router.get("/c/{code}", summary="群发短链落地(微信授权拿 openid + 记点击 + 跳转/淘宝落地页)")
+def cps_landing(code: str, request: Request, db: Session = Depends(get_db)):
+    link = cps_link_repo.get_by_code(db, code)
+    if link is None:
+        return RedirectResponse(_FALLBACK_URL, status_code=302)
+    openid = request.cookies.get(_WX_OPENID_COOKIE)
+    # 微信内 + 还没拿到 openid + 配了服务号 → 先 base 静默授权拿 openid,再 302 回本页。
+    # 非微信 / 已有 cookie / 未配服务号 → 直接走原逻辑(openid 可能为 None,绝不阻断领券)。
+    if openid is None and settings.wx_oauth_active and _is_wechat(request):
+        redirect_uri = f"{settings.CPS_REDIRECT_BASE.rstrip('/')}/wx/oauth/cb"
+        auth_url = wx_oauth.build_authorize_url(redirect_uri, "snsapi_base", f"base:{code}")
+        return RedirectResponse(auth_url, status_code=302)
+    _record(db, link, request, "visit", openid=openid)
+    if link.platform == "taobao":
+        activity = db.get(CpsActivity, link.activity_id)
+        image_url = (activity.image_url if activity else None) or _DEFAULT_TAOBAO_IMAGE
+        has_uinfo = request.cookies.get(_WX_UINFO_COOKIE) == "1"
+        return HTMLResponse(
+            _taobao_landing_html(link.target_url, image_url, code, openid, has_uinfo)
+        )
+    # 美团短链 / 京东链接:直接 302 跳
     return RedirectResponse(link.target_url, status_code=302)
+
+
+@router.get("/wx/oauth/cb", include_in_schema=False)
+def wx_oauth_cb(code: str, state: str, db: Session = Depends(get_db)):
+    """微信网页授权回调。state='base:{原code}'(静默拿 openid) 或 'uinfo:{原code}'(补昵称头像)。
+    换 openid(+userinfo)→ upsert 用户 → 种 cookie → 302 回落地页。任何失败兜底回落地页,
+    绝不阻断用户领券。"""
+    kind, _, orig_code = state.partition(":")
+    try:
+        token = wx_oauth.exchange_code(code)  # {openid, access_token, scope, ...}
+        openid = token["openid"]
+        link = cps_link_repo.get_by_code(db, orig_code)
+        group_id = link.group_id if link else None
+        nickname = headimgurl = unionid = None
+        if kind == "uinfo" and "userinfo" in (token.get("scope") or ""):
+            info = wx_oauth.get_userinfo(token["access_token"], openid)
+            nickname, headimgurl, unionid = (
+                info.get("nickname"), info.get("headimgurl"), info.get("unionid"),
+            )
+        cps_wx_user_repo.upsert(
+            db, openid=openid, code=orig_code, group_id=group_id,
+            nickname=nickname, headimgurl=headimgurl, unionid=unionid,
+        )
+    except Exception:
+        logger.exception("[wx_oauth] callback failed state=%s", state)
+        return RedirectResponse(f"/c/{orig_code}" if orig_code else _FALLBACK_URL, status_code=302)
+    # userinfo 授权回来带 ?authed=1,落地页据此自动触发复制(把"点领券→授权→复制"衔接为一步)
+    target = f"/c/{orig_code}" + ("?authed=1" if kind == "uinfo" else "")
+    resp = RedirectResponse(target, status_code=302)
+    resp.set_cookie(_WX_OPENID_COOKIE, openid, max_age=_COOKIE_MAX_AGE, httponly=True, samesite="lax")
+    if nickname:
+        resp.set_cookie(_WX_UINFO_COOKIE, "1", max_age=_COOKIE_MAX_AGE, samesite="lax")
+    return resp
+
+
+@router.post("/c/{code}/copy", summary="淘宝落地页点了「复制口令」(记 copy 事件,带 openid)")
+def cps_copy(code: str, request: Request, db: Session = Depends(get_db)) -> dict:
+    link = cps_link_repo.get_by_code(db, code)
+    if link is not None:
+        _record(db, link, request, "copy", openid=request.cookies.get(_WX_OPENID_COOKIE))
+    return {"ok": True}
+
+
+def _taobao_landing_html(
+    token: str, image_url: str, code: str, openid: str | None, has_uinfo: bool
+) -> str:
+    """淘宝落地页 H5(主视觉图按活动传入,复制淘口令按钮在 75% 屏高)。
+
+    image_url 经 html.escape 嵌入 <img src>(防注入);token 经 json.dumps 安全嵌入 JS。
+    uinfo_url:已有 openid 但还没拿过昵称头像时,生成 userinfo 授权链接 —— 用户点「领券」
+    时先跳它(交互触发,避免微信快照页),授权回来自动复制。已拿过 / 无 openid 则为空,直接复制。
+    """
+    safe_img = html.escape(media.to_abs_media_url(image_url) or image_url, quote=True)
+    uinfo_url = ""
+    if openid and not has_uinfo and settings.wx_oauth_active:
+        redirect_uri = f"{settings.CPS_REDIRECT_BASE.rstrip('/')}/wx/oauth/cb"
+        uinfo_url = wx_oauth.build_authorize_url(redirect_uri, "snsapi_userinfo", f"uinfo:{code}")
+    return (
+        _TAOBAO_HTML
+        .replace("__IMAGE_URL__", safe_img)
+        .replace("__UINFO_URL__", json.dumps(uinfo_url))
+        .replace("__TOKEN_JS__", json.dumps(token))
+    )
+
+
+_TAOBAO_HTML = """<!DOCTYPE html>
+<html lang="zh">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=no">
+<title>淘宝闪购 · 天天领红包</title>
+<style>
+*{margin:0;padding:0;box-sizing:border-box;-webkit-tap-highlight-color:transparent}
+body{font-family:-apple-system,"PingFang SC",sans-serif;background:#fff0ef;color:#333;min-height:100vh}
+.hero{display:block;width:100%}
+.btn-wrap{position:fixed;left:0;right:0;top:75vh;padding:0 20px}
+.btn{display:block;width:100%;background:linear-gradient(90deg,#ff5b5b,#ff3b3b);color:#fff;font-size:19px;font-weight:800;text-align:center;padding:16px;border:none;border-radius:30px;box-shadow:0 6px 16px rgba(255,59,59,.4)}
+.btn:active{transform:scale(.98)}
+.toast{position:fixed;left:50%;top:42%;transform:translate(-50%,-50%);background:rgba(0,0,0,.82);color:#fff;padding:12px 22px;border-radius:10px;font-size:15px;opacity:0;transition:opacity .25s;pointer-events:none;z-index:99;white-space:nowrap}
+.toast.show{opacity:1}
+</style>
+</head>
+<body>
+<img class="hero" src="__IMAGE_URL__" alt="淘宝闪购 天天领红包">
+<div class="btn-wrap"><button class="btn" onclick="copyToken()">复制口令去淘宝领红包</button></div>
+<div class="toast" id="toast"></div>
+<script>
+var TOKEN = __TOKEN_JS__;
+var UINFO_URL = __UINFO_URL__;  // 非空=还没拿昵称头像,点领券先跳它补(授权回来自动复制)
+function showToast(m){var t=document.getElementById('toast');t.textContent=m;t.classList.add('show');setTimeout(function(){t.classList.remove('show')},2200)}
+function reportCopy(){try{fetch(location.pathname+'/copy',{method:'POST',keepalive:true})}catch(e){}}
+function done(){showToast('复制成功!打开淘宝即可领取');reportCopy()}
+function fallback(){
+  var ta=document.createElement('textarea');ta.value=TOKEN;ta.style.position='fixed';ta.style.opacity='0';
+  document.body.appendChild(ta);ta.focus();ta.select();
+  try{document.execCommand('copy');done()}catch(e){showToast('复制失败,请长按手动复制')}
+  document.body.removeChild(ta);
+}
+function doCopy(){
+  if(navigator.clipboard&&window.isSecureContext){navigator.clipboard.writeText(TOKEN).then(done).catch(fallback)}
+  else{fallback()}
+}
+function copyToken(){
+  // 第一次领券且还没授权过昵称头像:先跳 userinfo 授权(用户点击=交互触发,避免快照页),
+  // 授权回来 ?authed=1 自动复制;已授权过/无 openid 则直接复制。
+  if(UINFO_URL){location.href=UINFO_URL;return}
+  doCopy();
+}
+// userinfo 授权回流(?authed=1):自动复制,把"点领券→授权→复制"衔接成一步无感
+if(location.search.indexOf('authed=1')>=0){doCopy()}
+</script>
+</body>
+</html>"""

app/api/v1/platform.py

@@ -2,6 +2,7 @@
 
 路由前缀 `/api/v1/platform`:
   GET /stats   首页三统计(帮助用户 / 完成比价 / 累计节省),按运营后台配的模式算。
+  GET /flags   客户端运营 feature flag(比价/领券期广告开关等),客户端拉取后缓存。
 
 展示模式(real/manual/random,每指标独立)与计算逻辑见 app/repositories/ops_stat.py。
 """
@@ -12,9 +13,17 @@ import logging
 from fastapi import APIRouter, Query
 
 from app.api.deps import DbSession
+from app.repositories import app_config
 from app.repositories import ops_marquee as marquee_crud
 from app.repositories import ops_stat as crud
-from app.schemas.platform import PlatformStatsOut, SavingsFeedItem, SavingsFeedOut
+from app.schemas.platform import (
+    AdConfigPublicOut,
+    AppFlagsOut,
+    AppVersionOut,
+    PlatformStatsOut,
+    SavingsFeedItem,
+    SavingsFeedOut,
+)
 
 logger = logging.getLogger("shagua.platform")
 
@@ -35,3 +44,38 @@ def stats(db: DbSession) -> PlatformStatsOut:
 def savings_feed(db: DbSession, limit: int = Query(8, ge=1, le=30)) -> SavingsFeedOut:
     items = marquee_crud.get_feed(db, limit=limit)
     return SavingsFeedOut(items=[SavingsFeedItem(**it) for it in items])
+
+
+@router.get("/flags", response_model=AppFlagsOut, summary="客户端运营 feature flag(不鉴权)")
+def flags(db: DbSession) -> AppFlagsOut:
+    """客户端拉取运营开关并缓存(app 启动 / 每场比价开始时刷新)。不鉴权:开关非敏感,
+    且比价无障碍服务取值时未必有登录态。值来自 app_config(admin 可改),空库回退默认。"""
+    return AppFlagsOut(
+        comparing_ad_enabled=bool(app_config.get_value(db, "comparing_ad_enabled")),
+    )
+
+
+@router.get("/ad-config", response_model=AdConfigPublicOut, summary="客户端拉广告配置(穿山甲ID+场景开关,不鉴权)")
+def ad_config(db: DbSession) -> AdConfigPublicOut:
+    """客户端启动/每场广告前拉,缓存后用:app_id + 各位ID + 各场景开关。
+    不含验签密钥;空库回退默认(=客户端内置值,维持现状)。"""
+    c = app_config.get_ad_config(db)
+    return AdConfigPublicOut(
+        app_id=c["app_id"],
+        reward_code_id=c["reward_code_id"],
+        compare_feed_code_id=c["compare_feed_code_id"],
+        coupon_feed_code_id=c["coupon_feed_code_id"],
+        reward_enabled=c["reward_enabled"],
+        compare_ad_enabled=c["compare_ad_enabled"],
+        coupon_ad_enabled=c["coupon_ad_enabled"],
+    )
+
+
+@router.get("/app-version", response_model=AppVersionOut, summary="最新 App 版本(OTA 检查更新,不鉴权)")
+def app_version(db: DbSession) -> AppVersionOut:
+    """客户端启动 / 手动检查更新时拉取。不鉴权:版本信息非敏感,且检查更新可能在登录前。
+    用 latest_version_code 与本机 versionCode 比;未配置(返回默认 0)时客户端视为已是最新。"""
+    data = app_config.get_app_version(db)
+    if not data:
+        return AppVersionOut()
+    return AppVersionOut(**data)

app/api/v1/user.py

@@ -18,6 +18,7 @@ from app.api.deps import CurrentUser, DbSession
 from app.core import media
 from app.repositories import onboarding as onboarding_repo
 from app.repositories import user as user_repo
+from app.repositories import wallet as wallet_repo
 from app.schemas.auth import UserOut
 from app.schemas.user import (
     OkResponse,
@@ -87,6 +88,17 @@ def onboarding_status(
 
 @router.delete("", response_model=OkResponse, summary="注销账号(软删除)")
 def delete_account(user: CurrentUser, db: DbSession) -> OkResponse:
+    # 资金前置校验:注销是软删 + 匿名化,余额一旦留在 deleted 行就锁死(既退不出、新号也
+    # 拿不回)。有可提现现金 / 在审提现单 → 拒绝注销,引导用户先把钱处理掉。
+    # (pending 提现转账已在途、对账 worker 不依赖 user.status 照常到账,故不拦 pending。)
+    if wallet_repo.get_cash_balance_cents(db, user.id) > 0:
+        raise HTTPException(
+            status_code=409, detail="账户还有未提现的现金余额,请先提现后再注销"
+        )
+    if wallet_repo.has_reviewing_withdraw(db, user.id):
+        raise HTTPException(
+            status_code=409, detail="有提现正在审核中,请等审核完成后再注销"
+        )
     media.delete_avatar(user.avatar_url)
     user_repo.soft_delete_account(db, user)
     logger.info("delete account user_id=%d", user.id)