feat(ad): 穿山甲广告配置后台化(app_id/各位ID/验签密钥/各场景开关)

- app_config 存 ad_config(默认=客户端当前内置 ID,空库维持现状)
- GET /platform/ad-config 下发客户端(不含验签密钥 reward_mkey)
- admin GET/PATCH /admin/api/ad-config 读写(operator/finance + 审计,mkey 不记明文)
- pangle 回调验签 m-key 优先读后台配置、.env 兜底兼容
- 比价/领券信息流位拆分(compare/coupon_feed_code_id)
- 客户端需发版接入 /platform/ad-config 才生效;本次后端就绪、不影响现状

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/admin/main.py

@@ -14,6 +14,7 @@ from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
 from app.admin.routers.ad_audit import router as ad_audit_router
+from app.admin.routers.ad_config import router as ad_config_router
 from app.admin.routers.ad_revenue import router as ad_revenue_router
 from app.admin.routers.admins import router as admins_router
 from app.admin.routers.audit import router as audit_router
@@ -95,4 +96,5 @@ admin_app.include_router(config_router)
 admin_app.include_router(comparison_router)
 admin_app.include_router(cps_router)
 admin_app.include_router(ad_audit_router)
+admin_app.include_router(ad_config_router)
 admin_app.include_router(ad_revenue_router)

app/admin/routers/ad_config.py

@@ -0,0 +1,45 @@
+"""admin 广告配置:读/写穿山甲 app_id / 各场景广告位ID / 验签密钥 / 各场景开关。
+
+存在 app_config 表的 ad_config dict(见 repositories/app_config.get_ad_config/set_ad_config)。
+客户端经 /api/v1/platform/ad-config 拉取(不含 reward_mkey)。权限 operator/finance + 审计。
+"""
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Request
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
+from app.admin.schemas.ad_config import AdConfigOut, AdConfigUpdate
+from app.models.admin import AdminUser
+from app.repositories import app_config
+
+router = APIRouter(
+    prefix="/admin/api/ad-config",
+    tags=["admin-ad-config"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get("", response_model=AdConfigOut, summary="广告配置(穿山甲ID/验签密钥/各场景开关)")
+def get_ad_config(db: AdminDb) -> AdConfigOut:
+    return AdConfigOut(**app_config.get_ad_config(db))
+
+
+@router.patch("", response_model=AdConfigOut, summary="改广告配置(部分更新,带审计)")
+def update_ad_config(
+    body: AdConfigUpdate,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator", "finance"))],
+    db: AdminDb,
+) -> AdConfigOut:
+    data = body.model_dump(exclude_none=True)
+    app_config.set_ad_config(db, data, admin_id=admin.id, commit=False)
+    # 审计只记改了哪些字段,不记 mkey 明文(机密)
+    write_audit(
+        db, admin, action="ad_config.set", target_type="ad_config", target_id="ad_config",
+        detail={"changed": sorted(data.keys())}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return AdConfigOut(**app_config.get_ad_config(db))

app/admin/schemas/ad_config.py

@@ -0,0 +1,30 @@
+"""admin 广告配置 schemas(穿山甲 app_id/各位ID/验签密钥/各场景开关)。"""
+from __future__ import annotations
+
+from pydantic import BaseModel
+
+
+class AdConfigOut(BaseModel):
+    """admin 读到的完整广告配置(含 reward_mkey;admin 有权见,但绝不经 /platform 下发客户端)。"""
+
+    app_id: str
+    reward_code_id: str
+    compare_feed_code_id: str
+    coupon_feed_code_id: str
+    reward_mkey: str
+    reward_enabled: bool
+    compare_ad_enabled: bool
+    coupon_ad_enabled: bool
+
+
+class AdConfigUpdate(BaseModel):
+    """部分更新:只改传入(非 None)字段。空串是合法值(如清空 mkey 回退 .env)。"""
+
+    app_id: str | None = None
+    reward_code_id: str | None = None
+    compare_feed_code_id: str | None = None
+    coupon_feed_code_id: str | None = None
+    reward_mkey: str | None = None
+    reward_enabled: bool | None = None
+    compare_ad_enabled: bool | None = None
+    coupon_ad_enabled: bool | None = None