安全加固:feed 广告金币钳制 + prod 弱密钥 fail-fast

#1 feed-reward 防刷(eCPM/时长由客户端上报,原本金额无上界):
- rewards.calculate_ad_reward_coin 在唯一计算口把 eCPM 钳到 AD_ECPM_MAX_FEN
  (¥500 CPM),feed 与 reward_video 回退客户端 eCPM 的路径一并护住;阈值高于
  所有真实值,不影响正规发奖。
- ad_feed_reward 单事件时长上限由 24h(8640 份)收紧为 FEED_MAX_DURATION_SECONDS
  =120s(12 份),挡伪造超长时长刷份数。叠加每日 500 条上限锁住日产出。

#2 prod 启动期强校验密钥(Settings._enforce_prod_secrets):
- APP_ENV=prod 时 JWT_SECRET_KEY / ADMIN_JWT_SECRET 为默认值/空/长度<16 即 raise,
  挡住 token 被伪造导致账号与后台失陷。INTERNAL_API_SECRET 默认空=端点关闭的安全
  默认态,不强制。dev 不触发。

测试:tests/ 140 passed(3 个失败为既有的 compare/coupon 透传层问题,与本改动无关)。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -40,13 +40,29 @@ MT_CPS_APP_KEY=
 MT_CPS_APP_SECRET=
 # 默认渠道追踪标识(sid),用于区分不同 app 的 CPS 数据
 MT_CPS_DEFAULT_SID=sgbjia
+# 美团调用走的代理。⚠️ 本机/内网开发直连美团会 SSL EOF,必须填本地代理(如 http://127.0.0.1:7897);
+# 线上国内服务器留空(=直连)。留空且本机直连失败时 /feed、/coupons、/top-sales 会返回空。
+MT_CPS_PROXY=
 
-# ===== Pricebot 上游 (领券业务透传目标) =====
-# 客户端调本服务的 /api/v1/coupon/step,我们透传到 pricebot-backend 的 /api/coupon/step。
+# ===== Pricebot 上游 (领券/比价业务透传目标) =====
+# 客户端调本服务的 /api/v1/coupon/step 等,我们透传到 pricebot-backend。
 # 本地开发用 localhost:8000。生产部署改成内网地址(如 http://pricebot.internal:8000)。
 PRICEBOT_BASE_URL=http://localhost:8000
+# 【多实例】单机多进程部署时,填逗号分隔的实例列表(端口与 pricebot 集群对齐),透传层按
+# trace_id 一致性 hash 选实例 → 同一比价所有帧落同一进程(进程内维护 state,无需 Redis)。
+# 留空 = 单实例(用上面的 PRICEBOT_BASE_URL)。详见 pricebot-backend/docs/并发部署设计.md
+# PRICEBOT_INSTANCES=http://127.0.0.1:8001,http://127.0.0.1:8002,http://127.0.0.1:8003,http://127.0.0.1:8004,http://127.0.0.1:8005,http://127.0.0.1:8006
 # 领券单帧最多 wait 6s,加网络往返,30s 兜底
 PRICEBOT_REQUEST_TIMEOUT_SEC=30
+# 比价(intent/recognize + price/step)透传超时:大上下文 LLM + 逐帧 LLM,给 60s
+PRICEBOT_COMPARE_TIMEOUT_SEC=60
+
+# ===== 内部端点 (server→server, pricebot 上报价格观测) =====
+# pricebot 比价 done 后把各平台到手价 POST 到本服务 /internal/price-observation 落库
+# (price_observation 表,比价资产沉淀层),靠共享密钥头 X-Internal-Secret 校验。
+# 必须与 pricebot 侧的 INTERNAL_API_SECRET **同值**;留空 = 内部写端点关闭(返 503)。
+# 启用前两边都填同一高熵串:python -c "import secrets; print(secrets.token_urlsafe(48))"
+INTERNAL_API_SECRET=
 
 # ===== CORS =====
 # 逗号分隔,生产留空(只让 app 调,不开放 web)。本地开发可加 http://localhost:5173 之类
@@ -63,6 +79,12 @@ WXPAY_MCH_PRIVATE_KEY_PATH=./secrets/apiclient_key.pem
 WXPAY_PUBLIC_KEY_ID=PUB_KEY_ID_xxxxxxxx
 WXPAY_PUBLIC_KEY_PATH=./secrets/pub_key.pem
 WXPAY_TRANSFER_SCENE_ID=1000
+WXPAY_AUTH_NOTIFY_URL=
+WITHDRAW_AUTO_RECONCILE_ENABLED=false
+WITHDRAW_AUTO_RECONCILE_INTERVAL_SEC=300
+WITHDRAW_AUTO_RECONCILE_OLDER_THAN_MINUTES=15
+# 0 点自动兑金币开关(deploy/daily-exchange.timer 触发的脚本读它;false=脚本 no-op)。默认 true。
+AUTO_EXCHANGE_ENABLED=true
 
 # ===== 穿山甲激励视频(服务端发奖回调)=====
 # 看完激励视频后穿山甲服务器 S2S 回调本服务发金币(客户端不参与发奖)。

.gitignore

@@ -23,7 +23,13 @@ dist/
 *.db-journal
 *.db-shm
 *.db-wal
-data/
+# data/ 整体不入库(运行时数据/上传文件/大二进制)。例外:邀请落地页 dl.html——
+# 它既是生产落地页又是本地测试资产,纳入 git 便于同事一致测试
+# (见 docs/邀请功能-实现原理与本地测试.md)。其余(avatars/ / *.apk / app.db 等)仍忽略。
+data/*
+!data/media/
+data/media/*
+!data/media/dl.html
 
 secrets/*
 !secrets/.gitkeep
@@ -37,3 +43,4 @@ secrets/*
 
 # 运行日志(run.sh 输出, 不入库)
 *.log
+logs/

alembic/versions/0cf18d590b1d_merge_coupon_state_and_invite_heads.py

@@ -0,0 +1,26 @@
+"""merge coupon_state and invite heads
+
+Revision ID: 0cf18d590b1d
+Revises: coupon_state_tables, invite_code_and_relation
+Create Date: 2026-06-08 05:49:29.604571
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '0cf18d590b1d'
+down_revision: Union[str, Sequence[str], None] = ('coupon_state_tables', 'invite_code_and_relation')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/11a1d08c6f55_merge_meituan_coupon_与_ops_price_.py

@@ -0,0 +1,26 @@
+"""merge meituan_coupon 与 ops/price_observation 迁移头
+
+Revision ID: 11a1d08c6f55
+Revises: meituan_coupon_table, opsrename01
+Create Date: 2026-06-08 00:06:01.633796
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '11a1d08c6f55'
+down_revision: Union[str, Sequence[str], None] = ('meituan_coupon_table', 'opsrename01')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/8ac524a8ea02_merge_comparison_and_savings_heads.py

@@ -0,0 +1,26 @@
+"""merge comparison and savings heads
+
+Revision ID: 8ac524a8ea02
+Revises: d4e5f6a7b8c9, savings_report_fields
+Create Date: 2026-06-02 09:53:06.924912
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '8ac524a8ea02'
+down_revision: Union[str, Sequence[str], None] = ('d4e5f6a7b8c9', 'savings_report_fields')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/9258bddde4ea_新增_price_report_上报更低价表.py

@@ -0,0 +1,65 @@
+"""新增 price_report 上报更低价表
+
+Revision ID: 9258bddde4ea
+Revises: ad60a1b2c3d4
+Create Date: 2026-06-05 10:15:51.508598
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '9258bddde4ea'
+down_revision: Union[str, Sequence[str], None] = 'ad60a1b2c3d4'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.create_table('price_report',
+    sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+    sa.Column('user_id', sa.Integer(), nullable=False),
+    sa.Column('comparison_record_id', sa.Integer(), nullable=True),
+    sa.Column('store_name', sa.String(length=128), nullable=True),
+    sa.Column('dish_summary', sa.String(length=256), nullable=True),
+    sa.Column('original_platform_id', sa.String(length=32), nullable=True),
+    sa.Column('original_platform_name', sa.String(length=32), nullable=True),
+    sa.Column('original_price_cents', sa.Integer(), nullable=True),
+    sa.Column('reported_platform_id', sa.String(length=32), nullable=False),
+    sa.Column('reported_platform_name', sa.String(length=32), nullable=False),
+    sa.Column('reported_price_cents', sa.Integer(), nullable=False),
+    sa.Column('images', sa.JSON(), nullable=False),
+    sa.Column('status', sa.String(length=16), nullable=False),
+    sa.Column('reject_reason', sa.String(length=256), nullable=True),
+    sa.Column('reward_coins', sa.Integer(), nullable=True),
+    sa.Column('reviewed_at', sa.DateTime(timezone=True), nullable=True),
+    sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+    sa.ForeignKeyConstraint(['comparison_record_id'], ['comparison_record.id'], ),
+    sa.ForeignKeyConstraint(['user_id'], ['user.id'], ),
+    sa.PrimaryKeyConstraint('id')
+    )
+    with op.batch_alter_table('price_report', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_price_report_comparison_record_id'), ['comparison_record_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_price_report_created_at'), ['created_at'], unique=False)
+        batch_op.create_index(batch_op.f('ix_price_report_status'), ['status'], unique=False)
+        batch_op.create_index(batch_op.f('ix_price_report_user_id'), ['user_id'], unique=False)
+    # 注:autogenerate 另检测到「删除 order_record 表」——那是已降级为审计的历史表
+    #     (model 已移除、库表保留),与本次无关,手动剔除,避免误删他人审计数据。
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    # (对称:upgrade 未删 order_record,downgrade 也不重建它)
+    with op.batch_alter_table('price_report', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_price_report_user_id'))
+        batch_op.drop_index(batch_op.f('ix_price_report_status'))
+        batch_op.drop_index(batch_op.f('ix_price_report_created_at'))
+        batch_op.drop_index(batch_op.f('ix_price_report_comparison_record_id'))
+
+    op.drop_table('price_report')
+    # ### end Alembic commands ###

alembic/versions/9b894f5fff05_merge_user_force_onboarding_and_.py

@@ -0,0 +1,26 @@
+"""merge user_force_onboarding and comparison_idx_coupon_daily heads
+
+Revision ID: 9b894f5fff05
+Revises: d4b87c5847de, user_force_onboarding
+Create Date: 2026-06-10 22:49:02.248506
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '9b894f5fff05'
+down_revision: Union[str, Sequence[str], None] = ('d4b87c5847de', 'user_force_onboarding')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/a8c47fc4dc39_merge_invite_fingerprint_and_ad_reward_.py

@@ -0,0 +1,26 @@
+"""merge invite_fingerprint and ad_reward heads
+
+Revision ID: a8c47fc4dc39
+Revises: invite_fingerprint_table, 044dce6e9b1f
+Create Date: 2026-06-10 01:03:03.699443
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'a8c47fc4dc39'
+down_revision: Union[str, Sequence[str], None] = ('invite_fingerprint_table', '044dce6e9b1f')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/ad_ecpm_record.py

@@ -0,0 +1,47 @@
+"""ad_ecpm_record table (广告展示 eCPM 上报记录,内部收益统计/对账)
+
+Revision ID: a1b2c3d4e5f6
+Revises: f01db5d77dac
+Create Date: 2026-05-31 11:30:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'a1b2c3d4e5f6'
+down_revision: Union[str, Sequence[str], None] = 'f01db5d77dac'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'ad_ecpm_record',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('user_id', sa.Integer(), nullable=False),
+        sa.Column('ad_type', sa.String(length=32), nullable=False),
+        sa.Column('adn', sa.String(length=32), nullable=True),
+        sa.Column('slot_id', sa.String(length=64), nullable=True),
+        sa.Column('ecpm_raw', sa.String(length=32), nullable=False),
+        sa.Column('report_date', sa.String(length=10), nullable=False),
+        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.ForeignKeyConstraint(['user_id'], ['user.id'], ),
+        sa.PrimaryKeyConstraint('id'),
+    )
+    with op.batch_alter_table('ad_ecpm_record', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_ad_ecpm_record_user_id'), ['user_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_ad_ecpm_record_report_date'), ['report_date'], unique=False)
+        batch_op.create_index(batch_op.f('ix_ad_ecpm_record_created_at'), ['created_at'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('ad_ecpm_record', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_ad_ecpm_record_created_at'))
+        batch_op.drop_index(batch_op.f('ix_ad_ecpm_record_report_date'))
+        batch_op.drop_index(batch_op.f('ix_ad_ecpm_record_user_id'))
+
+    op.drop_table('ad_ecpm_record')

alembic/versions/ad_feed_reward_session_id.py

@@ -0,0 +1,38 @@
+"""add ad_session_id to ad feed reward record
+
+Revision ID: ad_feed_reward_session
+Revises: coin_reward_phase2
+Create Date: 2026-06-09
+"""
+
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "ad_feed_reward_session"
+down_revision = "coin_reward_phase2"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "ad_feed_reward_record",
+        sa.Column("ad_session_id", sa.String(length=64), nullable=True),
+    )
+    op.create_index(
+        op.f("ix_ad_feed_reward_record_ad_session_id"),
+        "ad_feed_reward_record",
+        ["ad_session_id"],
+        unique=False,
+    )
+
+
+def downgrade() -> None:
+    op.drop_index(
+        op.f("ix_ad_feed_reward_record_ad_session_id"),
+        table_name="ad_feed_reward_record",
+    )
+    op.drop_column("ad_feed_reward_record", "ad_session_id")

alembic/versions/admin_tables.py

@@ -0,0 +1,65 @@
+"""admin_user + admin_audit_log tables (运营 admin 后台:账号 + 操作审计)
+
+Revision ID: ad60a1b2c3d4
+Revises: 8ac524a8ea02
+Create Date: 2026-06-03 10:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'ad60a1b2c3d4'
+down_revision: Union[str, Sequence[str], None] = '8ac524a8ea02'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'admin_user',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('username', sa.String(length=64), nullable=False),
+        sa.Column('password_hash', sa.String(length=255), nullable=False),
+        sa.Column('role', sa.String(length=20), nullable=False, server_default='operator'),
+        sa.Column('status', sa.String(length=20), nullable=False, server_default='active'),
+        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.Column('last_login_at', sa.DateTime(timezone=True), nullable=True),
+        sa.PrimaryKeyConstraint('id'),
+    )
+    with op.batch_alter_table('admin_user', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_admin_user_username'), ['username'], unique=True)
+
+    op.create_table(
+        'admin_audit_log',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('admin_id', sa.Integer(), nullable=False),
+        sa.Column('admin_username', sa.String(length=64), nullable=False),
+        sa.Column('action', sa.String(length=64), nullable=False),
+        sa.Column('target_type', sa.String(length=32), nullable=False),
+        sa.Column('target_id', sa.String(length=64), nullable=True),
+        sa.Column('detail', sa.JSON().with_variant(sa.dialects.postgresql.JSONB(), 'postgresql'), nullable=True),
+        sa.Column('ip', sa.String(length=64), nullable=True),
+        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.ForeignKeyConstraint(['admin_id'], ['admin_user.id'], ),
+        sa.PrimaryKeyConstraint('id'),
+    )
+    with op.batch_alter_table('admin_audit_log', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_admin_audit_log_admin_id'), ['admin_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_admin_audit_log_action'), ['action'], unique=False)
+        batch_op.create_index(batch_op.f('ix_admin_audit_log_created_at'), ['created_at'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('admin_audit_log', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_admin_audit_log_created_at'))
+        batch_op.drop_index(batch_op.f('ix_admin_audit_log_action'))
+        batch_op.drop_index(batch_op.f('ix_admin_audit_log_admin_id'))
+    op.drop_table('admin_audit_log')
+
+    with op.batch_alter_table('admin_user', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_admin_user_username'))
+    op.drop_table('admin_user')

alembic/versions/app_config_table.py

@@ -0,0 +1,33 @@
+"""app_config table (运营可配置项:rewards 常量等后台化)
+
+Revision ID: cfg1a2b3c4d5
+Revises: ad60a1b2c3d4
+Create Date: 2026-06-04 12:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'cfg1a2b3c4d5'
+down_revision: Union[str, Sequence[str], None] = 'ad60a1b2c3d4'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'app_config',
+        sa.Column('key', sa.String(length=64), nullable=False),
+        sa.Column('value', sa.JSON().with_variant(sa.dialects.postgresql.JSONB(), 'postgresql'), nullable=False),
+        sa.Column('updated_by_admin_id', sa.Integer(), nullable=True),
+        sa.Column('updated_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.PrimaryKeyConstraint('key'),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table('app_config')

alembic/versions/b7e2c1a9f4d3_comparison_record_best_deeplink.py

@@ -0,0 +1,32 @@
+"""comparison_record 加 best_deeplink(再次比价直达商家深链)
+
+Revision ID: b7e2c1a9f4d3
+Revises: 9258bddde4ea
+Create Date: 2026-06-05
+
+「再次比价」要直达上次最低价平台的商家/商品页。深链(link)在比价时客户端已从剪贴板采到
+(collectedLinks[best_index]),本列把它落库;再次比价时写剪贴板 + launch 该平台 App 直达。
+旧记录无此列值(None) → 前端降级为打开对应 App 首页。
+
+手写迁移(只加一列):autogenerate 会误报"删 order_record"(降级为审计的历史表,model 已移除、
+库表保留),手写规避该噪音。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "b7e2c1a9f4d3"
+down_revision: Union[str, Sequence[str], None] = "9258bddde4ea"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("comparison_record", schema=None) as batch_op:
+        batch_op.add_column(sa.Column("best_deeplink", sa.String(length=1024), nullable=True))
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("comparison_record", schema=None) as batch_op:
+        batch_op.drop_column("best_deeplink")

alembic/versions/coin_reward_points_phase1.py

@@ -0,0 +1,76 @@
+"""coin reward points phase 1 tables
+
+Revision ID: coin_reward_phase1
+Revises: pstat3growth
+Create Date: 2026-06-07 15:30:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'coin_reward_phase1'
+down_revision: Union[str, Sequence[str], None] = 'pstat3growth'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'signin_boost_record',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('user_id', sa.Integer(), nullable=False),
+        sa.Column('signin_date', sa.Date(), nullable=False),
+        sa.Column('coin_awarded', sa.Integer(), nullable=False),
+        sa.Column('ad_ref_id', sa.String(length=64), nullable=True),
+        sa.Column(
+            'created_at', sa.DateTime(timezone=True),
+            server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False,
+        ),
+        sa.ForeignKeyConstraint(['user_id'], ['user.id'], ),
+        sa.PrimaryKeyConstraint('id'),
+        sa.UniqueConstraint('user_id', 'signin_date', name='uq_signin_boost_user_date'),
+    )
+    with op.batch_alter_table('signin_boost_record', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_signin_boost_record_user_id'), ['user_id'], unique=False)
+
+    op.create_table(
+        'ad_feed_reward_record',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('client_event_id', sa.String(length=64), nullable=False),
+        sa.Column('user_id', sa.Integer(), nullable=False),
+        sa.Column('reward_date', sa.String(length=10), nullable=False),
+        sa.Column('duration_seconds', sa.Integer(), nullable=False),
+        sa.Column('unit_count', sa.Integer(), nullable=False),
+        sa.Column('ecpm_raw', sa.String(length=32), nullable=False),
+        sa.Column('adn', sa.String(length=32), nullable=True),
+        sa.Column('slot_id', sa.String(length=64), nullable=True),
+        sa.Column('coin', sa.Integer(), nullable=False),
+        sa.Column('status', sa.String(length=16), nullable=False),
+        sa.Column(
+            'created_at', sa.DateTime(timezone=True),
+            server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False,
+        ),
+        sa.ForeignKeyConstraint(['user_id'], ['user.id'], ),
+        sa.PrimaryKeyConstraint('id'),
+        sa.UniqueConstraint('client_event_id', name='uq_ad_feed_reward_client_event'),
+    )
+    with op.batch_alter_table('ad_feed_reward_record', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_ad_feed_reward_record_user_id'), ['user_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_ad_feed_reward_record_reward_date'), ['reward_date'], unique=False)
+        batch_op.create_index(batch_op.f('ix_ad_feed_reward_record_created_at'), ['created_at'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('ad_feed_reward_record', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_ad_feed_reward_record_created_at'))
+        batch_op.drop_index(batch_op.f('ix_ad_feed_reward_record_reward_date'))
+        batch_op.drop_index(batch_op.f('ix_ad_feed_reward_record_user_id'))
+    op.drop_table('ad_feed_reward_record')
+
+    with op.batch_alter_table('signin_boost_record', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_signin_boost_record_user_id'))
+    op.drop_table('signin_boost_record')

alembic/versions/coin_reward_points_phase2.py

@@ -0,0 +1,71 @@
+"""coin reward points phase2
+
+Revision ID: coin_reward_phase2
+Revises: 0cf18d590b1d
+Create Date: 2026-06-08
+"""
+
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "coin_reward_phase2"
+down_revision = "0cf18d590b1d"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "ad_ecpm_record",
+        sa.Column("ad_session_id", sa.String(length=64), nullable=True),
+    )
+    op.create_index(
+        op.f("ix_ad_ecpm_record_ad_session_id"),
+        "ad_ecpm_record",
+        ["ad_session_id"],
+        unique=False,
+    )
+    op.create_index(
+        "uq_ad_ecpm_record_session",
+        "ad_ecpm_record",
+        ["ad_session_id"],
+        unique=True,
+    )
+
+    op.add_column(
+        "ad_reward_record",
+        sa.Column(
+            "reward_scene",
+            sa.String(length=32),
+            nullable=False,
+            server_default="reward_video",
+        ),
+    )
+    op.add_column(
+        "ad_reward_record",
+        sa.Column("ad_session_id", sa.String(length=64), nullable=True),
+    )
+    op.add_column(
+        "ad_reward_record",
+        sa.Column("ecpm_raw", sa.String(length=32), nullable=True),
+    )
+    op.create_index(
+        op.f("ix_ad_reward_record_ad_session_id"),
+        "ad_reward_record",
+        ["ad_session_id"],
+        unique=False,
+    )
+
+
+def downgrade() -> None:
+    op.drop_index(op.f("ix_ad_reward_record_ad_session_id"), table_name="ad_reward_record")
+    op.drop_column("ad_reward_record", "ecpm_raw")
+    op.drop_column("ad_reward_record", "ad_session_id")
+    op.drop_column("ad_reward_record", "reward_scene")
+
+    op.drop_index("uq_ad_ecpm_record_session", table_name="ad_ecpm_record")
+    op.drop_index(op.f("ix_ad_ecpm_record_ad_session_id"), table_name="ad_ecpm_record")
+    op.drop_column("ad_ecpm_record", "ad_session_id")

alembic/versions/coin_transaction_task_ref_unique.py

@@ -0,0 +1,40 @@
+"""add coin_transaction task ref unique index
+
+可重复任务(task_enable_notification「打开消息提醒」逐次减半领取)的发放路径是无锁的
+读-算-写:并发/连点的两个 claim 会都读到同一已领次数、算出同一 ref_id(task_key:N)、
+各发一笔,导致双倍发钱。给 coin_transaction 加 (user_id, biz_type, ref_id) 部分唯一索引
+(仅 biz_type LIKE 'task%' 且 ref_id 非空),第二笔撞唯一约束 → IntegrityError,被
+task.claim_task 兜底成 AlreadyClaimedError(409)。与 cash_transaction 提现退款、
+withdraw_order 在途单的「唯一约束 + IntegrityError 兜底」同模式。
+
+Revision ID: coin_txn_task_ref_uq
+Revises: drop_force_onboarding
+Create Date: 2026-06-12 00:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = "coin_txn_task_ref_uq"
+down_revision: Union[str, Sequence[str], None] = "drop_force_onboarding"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_index(
+        "ux_coin_transaction_task_ref",
+        "coin_transaction",
+        ["user_id", "biz_type", "ref_id"],
+        unique=True,
+        sqlite_where=sa.text("biz_type LIKE 'task%' AND ref_id IS NOT NULL"),
+        postgresql_where=sa.text("biz_type LIKE 'task%' AND ref_id IS NOT NULL"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ux_coin_transaction_task_ref", table_name="coin_transaction")

alembic/versions/comparison_milestone_claim_table.py

@@ -0,0 +1,41 @@
+"""comparison_milestone_claim table (比价战绩里程碑领取记录)
+
+Revision ID: d4e5f6a7b8c9
+Revises: c3d4e5f6a7b8
+Create Date: 2026-05-31 18:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'd4e5f6a7b8c9'
+down_revision: Union[str, Sequence[str], None] = 'c3d4e5f6a7b8'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'comparison_milestone_claim',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('user_id', sa.Integer(), nullable=False),
+        sa.Column('milestone', sa.Integer(), nullable=False),
+        sa.Column('coin_awarded', sa.Integer(), nullable=False),
+        sa.Column('claimed_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.ForeignKeyConstraint(['user_id'], ['user.id'], ),
+        sa.PrimaryKeyConstraint('id'),
+        sa.UniqueConstraint('user_id', 'milestone', name='uq_compare_milestone_user'),
+    )
+    with op.batch_alter_table('comparison_milestone_claim', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_comparison_milestone_claim_user_id'), ['user_id'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('comparison_milestone_claim', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_comparison_milestone_claim_user_id'))
+
+    op.drop_table('comparison_milestone_claim')

alembic/versions/comparison_record_information.py

@@ -0,0 +1,28 @@
+"""comparison_record.information (done 帧文案/失败原因)
+
+Revision ID: c3d4e5f6a7b8
+Revises: b2c3d4e5f6a7
+Create Date: 2026-05-31 18:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'c3d4e5f6a7b8'
+down_revision: Union[str, Sequence[str], None] = 'b2c3d4e5f6a7'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('comparison_record', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('information', sa.String(length=256), nullable=True))
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('comparison_record', schema=None) as batch_op:
+        batch_op.drop_column('information')

alembic/versions/comparison_record_table.py

@@ -0,0 +1,64 @@
+"""comparison_record table (比价记录:每次比价完整明细,「我的比价记录」数据源)
+
+Revision ID: b2c3d4e5f6a7
+Revises: a1b2c3d4e5f6
+Create Date: 2026-05-31 15:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'b2c3d4e5f6a7'
+down_revision: Union[str, Sequence[str], None] = 'a1b2c3d4e5f6'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'comparison_record',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('user_id', sa.Integer(), nullable=False),
+        sa.Column('device_id', sa.String(length=64), nullable=True),
+        sa.Column('business_type', sa.String(length=16), nullable=False),
+        sa.Column('trace_id', sa.String(length=64), nullable=False),
+        sa.Column('source_platform_id', sa.String(length=32), nullable=True),
+        sa.Column('source_platform_name', sa.String(length=32), nullable=True),
+        sa.Column('source_package', sa.String(length=128), nullable=True),
+        sa.Column('source_price_cents', sa.Integer(), nullable=True),
+        sa.Column('best_platform_id', sa.String(length=32), nullable=True),
+        sa.Column('best_platform_name', sa.String(length=32), nullable=True),
+        sa.Column('best_price_cents', sa.Integer(), nullable=True),
+        sa.Column('saved_amount_cents', sa.Integer(), nullable=True),
+        sa.Column('is_source_best', sa.Boolean(), nullable=True),
+        sa.Column('store_name', sa.String(length=128), nullable=True),
+        sa.Column('total_dish_count', sa.Integer(), nullable=True),
+        sa.Column('skipped_dish_count', sa.Integer(), nullable=True),
+        sa.Column('status', sa.String(length=16), nullable=False),
+        # PG 上为 JSONB,其它(SQLite)为 JSON——与模型层 with_variant 对齐
+        sa.Column('items', sa.JSON().with_variant(sa.dialects.postgresql.JSONB(), 'postgresql'), nullable=False),
+        sa.Column('comparison_results', sa.JSON().with_variant(sa.dialects.postgresql.JSONB(), 'postgresql'), nullable=False),
+        sa.Column('skipped_dish_names', sa.JSON().with_variant(sa.dialects.postgresql.JSONB(), 'postgresql'), nullable=False),
+        sa.Column('raw_payload', sa.JSON().with_variant(sa.dialects.postgresql.JSONB(), 'postgresql'), nullable=True),
+        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.ForeignKeyConstraint(['user_id'], ['user.id'], ),
+        sa.PrimaryKeyConstraint('id'),
+        sa.UniqueConstraint('user_id', 'trace_id', name='uq_comparison_user_trace'),
+    )
+    with op.batch_alter_table('comparison_record', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_comparison_record_user_id'), ['user_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_comparison_record_business_type'), ['business_type'], unique=False)
+        batch_op.create_index(batch_op.f('ix_comparison_record_created_at'), ['created_at'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('comparison_record', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_comparison_record_created_at'))
+        batch_op.drop_index(batch_op.f('ix_comparison_record_business_type'))
+        batch_op.drop_index(batch_op.f('ix_comparison_record_user_id'))
+
+    op.drop_table('comparison_record')

alembic/versions/comparison_status_created_idx.py

@@ -0,0 +1,48 @@
+"""add composite index (status, created_at) on comparison_record
+
+首页轮播 feed(按 status='success' 过滤 + created_at 近期排序)与省钱战绩聚合
+都吃这个过滤+排序;复合索引避免随数据量增大退化成全表扫。
+
+Revision ID: comparison_status_created_idx
+Revises: a8c47fc4dc39
+Create Date: 2026-06-10
+"""
+
+from __future__ import annotations
+
+from alembic import op
+
+revision = "comparison_status_created_idx"
+down_revision = "a8c47fc4dc39"
+branch_labels = None
+depends_on = None
+
+INDEX_NAME = "ix_comparison_status_created"
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    if bind.dialect.name == "postgresql":
+        # PG 上 comparison_record 已有数据量, 普通 CREATE INDEX 持表写锁会阻塞线上写入;
+        # 用 CONCURRENTLY 不锁表(须脱离事务, autocommit_block 切到自动提交)。
+        with op.get_context().autocommit_block():
+            op.create_index(
+                INDEX_NAME, "comparison_record", ["status", "created_at"],
+                unique=False, postgresql_concurrently=True,
+            )
+    else:
+        op.create_index(
+            INDEX_NAME, "comparison_record", ["status", "created_at"], unique=False
+        )
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    if bind.dialect.name == "postgresql":
+        with op.get_context().autocommit_block():
+            op.drop_index(
+                INDEX_NAME, table_name="comparison_record",
+                postgresql_concurrently=True,
+            )
+    else:
+        op.drop_index(INDEX_NAME, table_name="comparison_record")

alembic/versions/coupon_daily_completion_table.py

@@ -0,0 +1,58 @@
+"""coupon daily completion table(今日跑完整轮领券 → 首页置灰源)
+
+Revision ID: coupon_daily_completion
+Revises: f8d3b1e60a27
+Create Date: 2026-06-10 00:00:00.000000
+
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "coupon_daily_completion"
+down_revision: str | Sequence[str] | None = "f8d3b1e60a27"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "coupon_daily_completion",
+        sa.Column("id", sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column("device_id", sa.String(length=64), nullable=False),
+        sa.Column("user_id", sa.Integer(), nullable=True),
+        sa.Column("complete_date", sa.Date(), nullable=False),
+        sa.Column("trace_id", sa.String(length=64), nullable=True),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("(CURRENT_TIMESTAMP)"),
+            nullable=False,
+        ),
+        sa.Column(
+            "updated_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("(CURRENT_TIMESTAMP)"),
+            nullable=False,
+        ),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("device_id", "complete_date", name="uq_coupon_completion_device_date"),
+    )
+    with op.batch_alter_table("coupon_daily_completion", schema=None) as batch_op:
+        batch_op.create_index(
+            batch_op.f("ix_coupon_daily_completion_user_id"), ["user_id"], unique=False
+        )
+        batch_op.create_index(
+            batch_op.f("ix_coupon_daily_completion_trace_id"), ["trace_id"], unique=False
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("coupon_daily_completion", schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f("ix_coupon_daily_completion_trace_id"))
+        batch_op.drop_index(batch_op.f("ix_coupon_daily_completion_user_id"))
+    op.drop_table("coupon_daily_completion")

alembic/versions/coupon_state_tables.py

@@ -0,0 +1,77 @@
+"""coupon state tables (领券今日状态:弹窗频控 engagement + 领券记录 claim)
+
+Revision ID: coupon_state_tables
+Revises: 11a1d08c6f55
+Create Date: 2026-06-08 00:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'coupon_state_tables'
+down_revision: Union[str, Sequence[str], None] = '11a1d08c6f55'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+# PG 上为 JSONB,其它(SQLite dev)为 JSON——与模型层 with_variant 对齐
+_JSON = sa.JSON().with_variant(postgresql.JSONB(), 'postgresql')
+
+
+def upgrade() -> None:
+    # 领券记录(资产层,当前不参与去重判断)
+    op.create_table(
+        'coupon_claim_record',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('device_id', sa.String(length=64), nullable=False),
+        sa.Column('user_id', sa.Integer(), nullable=True),
+        sa.Column('coupon_id', sa.String(length=64), nullable=False),
+        sa.Column('claim_date', sa.Date(), nullable=False),
+        sa.Column('status', sa.String(length=24), nullable=False),
+        sa.Column('vendor', sa.String(length=48), nullable=True),
+        sa.Column('coupon_name', sa.String(length=128), nullable=True),
+        sa.Column('claimed_count', sa.Integer(), nullable=True),
+        sa.Column('trace_id', sa.String(length=64), nullable=True),
+        sa.Column('reason', sa.String(length=255), nullable=True),
+        sa.Column('extra', _JSON, nullable=True),
+        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.Column('updated_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.PrimaryKeyConstraint('id'),
+        sa.UniqueConstraint('device_id', 'coupon_id', 'claim_date', name='uq_coupon_claim_device_coupon_date'),
+    )
+    with op.batch_alter_table('coupon_claim_record', schema=None) as batch_op:
+        batch_op.create_index('ix_coupon_claim_device_date', ['device_id', 'claim_date'], unique=False)
+        batch_op.create_index(batch_op.f('ix_coupon_claim_record_user_id'), ['user_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_coupon_claim_record_trace_id'), ['trace_id'], unique=False)
+
+    # 弹窗频控(今天 engage 过就不再弹)
+    op.create_table(
+        'coupon_prompt_engagement',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('device_id', sa.String(length=64), nullable=False),
+        sa.Column('user_id', sa.Integer(), nullable=True),
+        sa.Column('engage_date', sa.Date(), nullable=False),
+        sa.Column('engage_type', sa.String(length=16), nullable=False),
+        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.Column('updated_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.PrimaryKeyConstraint('id'),
+        sa.UniqueConstraint('device_id', 'engage_date', name='uq_coupon_engage_device_date'),
+    )
+    with op.batch_alter_table('coupon_prompt_engagement', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_coupon_prompt_engagement_user_id'), ['user_id'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('coupon_prompt_engagement', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_coupon_prompt_engagement_user_id'))
+    op.drop_table('coupon_prompt_engagement')
+
+    with op.batch_alter_table('coupon_claim_record', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_coupon_claim_record_trace_id'))
+        batch_op.drop_index(batch_op.f('ix_coupon_claim_record_user_id'))
+        batch_op.drop_index('ix_coupon_claim_device_date')
+    op.drop_table('coupon_claim_record')

alembic/versions/d4b87c5847de_merge_comparison_idx_and_coupon_daily_.py

@@ -0,0 +1,26 @@
+"""merge comparison idx and coupon daily completion heads
+
+Revision ID: d4b87c5847de
+Revises: comparison_status_created_idx, onboarding_completion
+Create Date: 2026-06-10 16:45:50.285917
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'd4b87c5847de'
+down_revision: Union[str, Sequence[str], None] = ('comparison_status_created_idx', 'onboarding_completion')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/drop_user_force_onboarding.py

@@ -0,0 +1,40 @@
+"""drop user.force_onboarding column
+
+force_onboarding(运营「按用户」强制新手引导)机制废弃:客户端实际按 onboarding_completion
+(设备+账号 维度)判断是否走引导,该 force_onboarding 列从未被客户端正确响应(被
+onboarding_completed 压过)。改用 admin「设备维度」重置(删 onboarding_completion 记录)替代,
+见 app/admin/routers/onboarding.py。本迁移删列。
+
+Revision ID: drop_force_onboarding
+Revises: 9b894f5fff05
+Create Date: 2026-06-12 00:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = "drop_force_onboarding"
+down_revision: Union[str, Sequence[str], None] = "9b894f5fff05"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.drop_column("user", "force_onboarding")
+
+
+def downgrade() -> None:
+    # 回滚:重建列(同 user_force_onboarding 迁移的 upgrade)。sa.false() 两端兼容。
+    op.add_column(
+        "user",
+        sa.Column(
+            "force_onboarding",
+            sa.Boolean(),
+            nullable=False,
+            server_default=sa.false(),
+        ),
+    )

alembic/versions/ebb6af5c0b56_merge_app_config_and_price_report_heads.py

@@ -0,0 +1,26 @@
+"""merge app_config and price_report heads
+
+Revision ID: ebb6af5c0b56
+Revises: cfg1a2b3c4d5, b7e2c1a9f4d3
+Create Date: 2026-06-06 02:29:13.475265
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'ebb6af5c0b56'
+down_revision: Union[str, Sequence[str], None] = ('cfg1a2b3c4d5', 'b7e2c1a9f4d3')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/f01db5d77dac_merge_pg_jsonb_and_feedback_heads.py

@@ -0,0 +1,26 @@
+"""merge pg_jsonb and feedback heads
+
+Revision ID: f01db5d77dac
+Revises: ef96beb47b1e, d1e2f3a4b5c6
+Create Date: 2026-05-29 16:09:58.498935
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'f01db5d77dac'
+down_revision: Union[str, Sequence[str], None] = ('ef96beb47b1e', 'd1e2f3a4b5c6')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/f8d3b1e60a27_add_debug_trace_and_merge_heads.py

@@ -0,0 +1,49 @@
+"""add user.debug_trace_enabled + comparison_record.trace_url
+
+调试链接权限功能：
+  - user.debug_trace_enabled：运营后台给指定用户开「复制调试链接」权限
+  - comparison_record.trace_url：比价记录页「复制调试链接」的数据（pricebot done 帧给，
+    dir 名含落盘时分秒、前端/server 拼不出，必须落库）
+
+注：本迁移最初基于旧 main（#31，双 head）写、down_revision 曾指向那对父；但 #33 已用
+a8c47fc4dc39 合并了那对双 head，故改为线性接在 a8c47fc4dc39 之后、只负责加两列
+（避免与 a8c47fc4dc39 平行再造一个双 head）。
+
+Revision ID: f8d3b1e60a27
+Revises: a8c47fc4dc39
+Create Date: 2026-06-10 02:40:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = "f8d3b1e60a27"
+down_revision: Union[str, Sequence[str], None] = "a8c47fc4dc39"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # sa.false() 渲染成 PG 的 false / SQLite 的 0，两端兼容（避免字符串 "false" 在 SQLite 上存歪）
+    op.add_column(
+        "user",
+        sa.Column(
+            "debug_trace_enabled",
+            sa.Boolean(),
+            nullable=False,
+            server_default=sa.false(),
+        ),
+    )
+    op.add_column(
+        "comparison_record",
+        sa.Column("trace_url", sa.String(length=512), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("comparison_record", "trace_url")
+    op.drop_column("user", "debug_trace_enabled")

alembic/versions/invite_code_and_relation.py

@@ -0,0 +1,54 @@
+"""user.invite_code + invite_relation table
+
+Revision ID: invite_code_and_relation
+Revises: 11a1d08c6f55
+Create Date: 2026-06-08 00:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'invite_code_and_relation'
+down_revision: Union[str, Sequence[str], None] = '11a1d08c6f55'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # user 加邀请码列(唯一索引;nullable 允许多个 NULL=未生成的用户)
+    with op.batch_alter_table('user', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('invite_code', sa.String(length=16), nullable=True))
+        batch_op.create_index('ix_user_invite_code', ['invite_code'], unique=True)
+
+    # 邀请关系表
+    op.create_table(
+        'invite_relation',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('inviter_user_id', sa.Integer(), nullable=False),
+        sa.Column('invitee_user_id', sa.Integer(), nullable=False),
+        sa.Column('channel', sa.String(length=16), nullable=False, server_default='clipboard'),
+        sa.Column('status', sa.String(length=16), nullable=False, server_default='effective'),
+        sa.Column('inviter_coin', sa.Integer(), nullable=False, server_default='0'),
+        sa.Column('invitee_coin', sa.Integer(), nullable=False, server_default='0'),
+        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.ForeignKeyConstraint(['inviter_user_id'], ['user.id']),
+        sa.ForeignKeyConstraint(['invitee_user_id'], ['user.id']),
+        sa.PrimaryKeyConstraint('id'),
+    )
+    op.create_index('ix_invite_relation_inviter_user_id', 'invite_relation', ['inviter_user_id'])
+    op.create_index('ix_invite_relation_invitee_user_id', 'invite_relation', ['invitee_user_id'], unique=True)
+    op.create_index('ix_invite_relation_created_at', 'invite_relation', ['created_at'])
+
+
+def downgrade() -> None:
+    op.drop_index('ix_invite_relation_created_at', table_name='invite_relation')
+    op.drop_index('ix_invite_relation_invitee_user_id', table_name='invite_relation')
+    op.drop_index('ix_invite_relation_inviter_user_id', table_name='invite_relation')
+    op.drop_table('invite_relation')
+    with op.batch_alter_table('user', schema=None) as batch_op:
+        batch_op.drop_index('ix_user_invite_code')
+        batch_op.drop_column('invite_code')

alembic/versions/invite_fingerprint_table.py

@@ -0,0 +1,50 @@
+"""invite_fingerprint table (任务 3 指纹归因兜底)
+
+Revision ID: invite_fingerprint_table
+Revises: 0cf18d590b1d
+Create Date: 2026-06-08 14:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'invite_fingerprint_table'
+down_revision: Union[str, Sequence[str], None] = '0cf18d590b1d'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # 邀请指纹归因表:落地页访问时记一行,登录后剪贴板没拿到邀请码时反查
+    op.create_table(
+        'invite_fingerprint',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('inviter_user_id', sa.Integer(), nullable=False),
+        sa.Column('ip', sa.String(length=64), nullable=False),
+        sa.Column('device_model', sa.String(length=64), nullable=False, server_default=''),
+        sa.Column('screen', sa.String(length=32), nullable=False, server_default=''),
+        sa.Column('user_agent', sa.Text(), nullable=False, server_default=''),
+        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.ForeignKeyConstraint(['inviter_user_id'], ['user.id']),
+        sa.PrimaryKeyConstraint('id'),
+    )
+    # 反查主索引:(ip, screen, device_model, created_at)
+    # /bind 兜底分支 WHERE ip=? AND screen=? AND device_model=? AND created_at > now - 7d
+    # ORDER BY created_at DESC LIMIT 1 — SQLite/PG 优化器都能反向扫该索引
+    op.create_index(
+        'ix_invite_fp_match',
+        'invite_fingerprint',
+        ['ip', 'screen', 'device_model', 'created_at'],
+    )
+    # 兜底/统计索引:按 inviter 看"这个邀请人的落地页被谁访问过"
+    op.create_index('ix_invite_fp_inviter', 'invite_fingerprint', ['inviter_user_id'])
+
+
+def downgrade() -> None:
+    op.drop_index('ix_invite_fp_inviter', table_name='invite_fingerprint')
+    op.drop_index('ix_invite_fp_match', table_name='invite_fingerprint')
+    op.drop_table('invite_fingerprint')

alembic/versions/marquee_seed_range.py

@@ -0,0 +1,50 @@
+"""marquee_seed 升级为「生成规则」:用户名可空 + 金额拆 min/max 区间
+
+把种子从「死记录」升级:
+- masked_user 改 nullable(留空 → feed 随机合成脱敏用户名)
+- saved_amount_cents(单值)拆成 min_cents / max_cents(feed 在区间内随机取值;固定金额则相等)
+现有 6 条种子:min_cents = max_cents = 原 saved_amount_cents,masked_user 原样保留。
+
+Revision ID: marquee_seed02
+Revises: marquee_seed01
+Create Date: 2026-06-07 11:00:00.000000
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = 'marquee_seed02'
+down_revision: Union[str, Sequence[str], None] = 'marquee_seed01'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # 1) 先加可空新列,使现有行合法
+    with op.batch_alter_table('marquee_seed', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('min_cents', sa.Integer(), nullable=True))
+        batch_op.add_column(sa.Column('max_cents', sa.Integer(), nullable=True))
+    # 2) 用旧单值回填区间(固定金额)
+    op.execute('UPDATE marquee_seed SET min_cents = saved_amount_cents, max_cents = saved_amount_cents')
+    # 3) 收紧:区间非空、用户名可空、删旧列
+    with op.batch_alter_table('marquee_seed', schema=None) as batch_op:
+        batch_op.alter_column('min_cents', existing_type=sa.Integer(), nullable=False)
+        batch_op.alter_column('max_cents', existing_type=sa.Integer(), nullable=False)
+        batch_op.alter_column('masked_user', existing_type=sa.String(length=64), nullable=True)
+        batch_op.drop_column('saved_amount_cents')
+
+
+def downgrade() -> None:
+    # 反向:恢复单值列(取下限),用户名回非空
+    with op.batch_alter_table('marquee_seed', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('saved_amount_cents', sa.Integer(), nullable=True))
+    op.execute('UPDATE marquee_seed SET saved_amount_cents = min_cents')
+    # 自动合成名的种子 masked_user 为 NULL,降级前补占位符以满足非空
+    op.execute("UPDATE marquee_seed SET masked_user = '用户********000' WHERE masked_user IS NULL")
+    with op.batch_alter_table('marquee_seed', schema=None) as batch_op:
+        batch_op.alter_column('saved_amount_cents', existing_type=sa.Integer(), nullable=False)
+        batch_op.alter_column('masked_user', existing_type=sa.String(length=64), nullable=False)
+        batch_op.drop_column('max_cents')
+        batch_op.drop_column('min_cents')

alembic/versions/marquee_seed_table.py

@@ -0,0 +1,52 @@
+"""marquee_seed table (首页轮播种子) + 合并 platform_stat / price_observation 两 head
+
+Revision ID: marquee_seed01
+Revises: pstat2anchor01, price_observation_table
+Create Date: 2026-06-07 10:00:00.000000
+
+兼并当前两个 head 为单 head,同时建 marquee_seed 表并播种客户端原写死的 6 条轮播
+(作为初始种子,保证上线即有内容)。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = 'marquee_seed01'
+down_revision: Union[str, Sequence[str], None] = ('pstat2anchor01', 'price_observation_table')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    table = op.create_table(
+        'marquee_seed',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('masked_user', sa.String(length=64), nullable=False),
+        sa.Column('saved_amount_cents', sa.Integer(), nullable=False),
+        sa.Column('enabled', sa.Boolean(), nullable=False, server_default=sa.true()),
+        sa.Column('sort_order', sa.Integer(), nullable=False, server_default='0'),
+        sa.Column(
+            'created_at', sa.DateTime(timezone=True),
+            server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False,
+        ),
+        sa.PrimaryKeyConstraint('id'),
+    )
+
+    # 初始种子 = 客户端原写死的 6 条(金额转成分)
+    op.bulk_insert(
+        table,
+        [
+            {'masked_user': '用户********a52', 'saved_amount_cents': 1860, 'enabled': True, 'sort_order': 1},
+            {'masked_user': '用户********k89', 'saved_amount_cents': 4240, 'enabled': True, 'sort_order': 2},
+            {'masked_user': '用户********m71', 'saved_amount_cents': 790, 'enabled': True, 'sort_order': 3},
+            {'masked_user': '用户********p46', 'saved_amount_cents': 15630, 'enabled': True, 'sort_order': 4},
+            {'masked_user': '用户********r93', 'saved_amount_cents': 2350, 'enabled': True, 'sort_order': 5},
+            {'masked_user': '用户********c28', 'saved_amount_cents': 8940, 'enabled': True, 'sort_order': 6},
+        ],
+    )
+
+
+def downgrade() -> None:
+    op.drop_table('marquee_seed')

alembic/versions/meituan_coupon_table.py

@@ -0,0 +1,62 @@
+"""meituan_coupon table(美团 CPS 券本地缓存,供销量/佣金排序从库里捞、本地排序)
+
+Revision ID: meituan_coupon_table
+Revises: withdraw_review_ad_watch
+Create Date: 2026-06-06 12:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'meituan_coupon_table'
+down_revision: Union[str, Sequence[str], None] = 'withdraw_review_ad_watch'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'meituan_coupon',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('source', sa.String(length=16), nullable=False),
+        sa.Column('platform', sa.Integer(), nullable=False),
+        sa.Column('biz_line', sa.Integer(), nullable=True),
+        sa.Column('city_id', sa.String(length=32), nullable=False),
+        sa.Column('product_view_sign', sa.String(length=128), nullable=False),
+        sa.Column('sku_view_id', sa.String(length=128), nullable=True),
+        sa.Column('name', sa.String(length=256), nullable=True),
+        sa.Column('brand_name', sa.String(length=128), nullable=True),
+        sa.Column('sell_price_cents', sa.Integer(), nullable=True),
+        sa.Column('original_price_cents', sa.Integer(), nullable=True),
+        sa.Column('head_url', sa.String(length=512), nullable=True),
+        sa.Column('sale_volume', sa.String(length=32), nullable=True),
+        sa.Column('sale_volume_num', sa.Integer(), nullable=True),
+        sa.Column('commission_percent', sa.Float(), nullable=True),
+        sa.Column('commission_amount_cents', sa.Integer(), nullable=True),
+        sa.Column('poi_name', sa.String(length=128), nullable=True),
+        sa.Column('available_poi_num', sa.Integer(), nullable=True),
+        sa.Column('delivery_distance_m', sa.Float(), nullable=True),
+        sa.Column('dedup_key', sa.String(length=64), nullable=False),
+        sa.Column('raw', sa.JSON().with_variant(postgresql.JSONB(), 'postgresql'), nullable=False),
+        sa.Column('first_seen', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.Column('last_seen', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.Column('updated_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.PrimaryKeyConstraint('id'),
+        sa.UniqueConstraint('source', 'product_view_sign', name='uq_meituan_coupon_source_sign'),
+    )
+    op.create_index('ix_meituan_coupon_source', 'meituan_coupon', ['source'])
+    op.create_index('ix_meituan_coupon_city_id', 'meituan_coupon', ['city_id'])
+    op.create_index('ix_meituan_coupon_brand_name', 'meituan_coupon', ['brand_name'])
+    op.create_index('ix_meituan_coupon_sale_volume_num', 'meituan_coupon', ['sale_volume_num'])
+    op.create_index('ix_meituan_coupon_commission_percent', 'meituan_coupon', ['commission_percent'])
+    op.create_index('ix_meituan_coupon_dedup_key', 'meituan_coupon', ['dedup_key'])
+    op.create_index('ix_meituan_coupon_last_seen', 'meituan_coupon', ['last_seen'])
+
+
+def downgrade() -> None:
+    op.drop_table('meituan_coupon')

alembic/versions/merge_ad_feed_reward_session_and_withdraw_safety_heads.py

@@ -0,0 +1,26 @@
+"""merge ad feed reward session and withdraw safety heads
+
+Revision ID: 044dce6e9b1f
+Revises: ad_feed_reward_session, withdraw_safety_indexes
+Create Date: 2026-06-09 09:52:08.276767
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '044dce6e9b1f'
+down_revision: Union[str, Sequence[str], None] = ('ad_feed_reward_session', 'withdraw_safety_indexes')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/onboarding_completion_table.py

@@ -0,0 +1,39 @@
+"""onboarding_completion table (新手引导完成标记,按 user+device 去重)
+
+Revision ID: onboarding_completion
+Revises: coupon_daily_completion
+Create Date: 2026-06-10 00:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'onboarding_completion'
+down_revision: Union[str, Sequence[str], None] = 'coupon_daily_completion'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # (账号, 设备) 一条完成标记;device_id = 客户端硬件级 ANDROID_ID(跨卸载重装稳定)。
+    op.create_table(
+        'onboarding_completion',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('user_id', sa.Integer(), nullable=False),
+        sa.Column('device_id', sa.String(length=64), nullable=False),
+        sa.Column('completed_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.PrimaryKeyConstraint('id'),
+        sa.UniqueConstraint('user_id', 'device_id', name='uq_onboarding_user_device'),
+    )
+    with op.batch_alter_table('onboarding_completion', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_onboarding_completion_user_id'), ['user_id'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('onboarding_completion', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_onboarding_completion_user_id'))
+    op.drop_table('onboarding_completion')

alembic/versions/ops_rename_tables.py

@@ -0,0 +1,28 @@
+"""运营可配表加 ops_ 前缀:platform_stat_display→ops_stat_config / marquee_seed→ops_marquee_seed
+
+把首页门面数据的两张「运营可配」表重命名,与代码侧 ops_ 前缀(模型 OpsStatConfig/OpsMarqueeSeed、
+repo ops_stat/ops_marquee、admin ops_stat_config/ops_marquee_seed)对齐。仅改表名,不动列与数据。
+
+Revision ID: opsrename01
+Revises: coin_reward_phase1
+Create Date: 2026-06-07 16:00:00.000000
+"""
+from typing import Sequence, Union
+
+from alembic import op
+
+
+revision: str = 'opsrename01'
+down_revision: Union[str, Sequence[str], None] = 'coin_reward_phase1'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.rename_table('platform_stat_display', 'ops_stat_config')
+    op.rename_table('marquee_seed', 'ops_marquee_seed')
+
+
+def downgrade() -> None:
+    op.rename_table('ops_stat_config', 'platform_stat_display')
+    op.rename_table('ops_marquee_seed', 'marquee_seed')

alembic/versions/platform_stat_anchor_minutes.py

@@ -0,0 +1,30 @@
+"""platform_stat_display 增加 random_anchor_minutes(自增长触发时刻对齐偏移)
+
+Revision ID: pstat2anchor01
+Revises: pstat1d2e3f4a
+Create Date: 2026-06-06 13:00:00.000000
+
+自增长 tick 从「启动时刻 + 间隔」改为「北京时间钟点对齐(anchor + k*interval)」,
+新增列存对齐偏移(距 0 点分钟数)。已有行默认 0(= 对齐到自然边界:天→0点、小时→整点)。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = 'pstat2anchor01'
+down_revision: Union[str, Sequence[str], None] = 'pstat1d2e3f4a'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        'platform_stat_display',
+        sa.Column('random_anchor_minutes', sa.Integer(), nullable=False, server_default='0'),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column('platform_stat_display', 'random_anchor_minutes')

alembic/versions/platform_stat_display_table.py

@@ -0,0 +1,59 @@
+"""platform_stat_display table (首页三统计展示配置:每指标独立 real/manual/random)
+
+Revision ID: pstat1d2e3f4a
+Revises: withdraw_review_ad_watch
+Create Date: 2026-06-06 12:00:00.000000
+
+播种 3 行:默认 manual + 客户端原写死门面值(12847 人 / 86532 次 / 37621.4 元),
+保证上线前后展示一致,运营再按需切模式。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'pstat1d2e3f4a'
+down_revision: Union[str, Sequence[str], None] = 'withdraw_review_ad_watch'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    table = op.create_table(
+        'platform_stat_display',
+        sa.Column('metric', sa.String(length=32), nullable=False),
+        sa.Column('mode', sa.String(length=16), nullable=False),
+        sa.Column('manual_value', sa.Integer(), nullable=True),
+        sa.Column('random_mult_min', sa.Integer(), nullable=False),
+        sa.Column('random_mult_max', sa.Integer(), nullable=False),
+        sa.Column('random_tick_seconds', sa.Integer(), nullable=False),
+        sa.Column('random_current', sa.Integer(), nullable=True),
+        sa.Column('random_last_tick_at', sa.DateTime(timezone=True), nullable=True),
+        sa.Column('updated_by_admin_id', sa.Integer(), nullable=True),
+        sa.Column(
+            'updated_at', sa.DateTime(timezone=True),
+            server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False,
+        ),
+        sa.PrimaryKeyConstraint('metric'),
+    )
+
+    _common = {
+        'mode': 'manual',
+        'random_mult_min': 1000,  # 1.000(只增不减下限)
+        'random_mult_max': 1100,  # 1.100
+        'random_tick_seconds': 86400,  # 1 天
+    }
+    op.bulk_insert(
+        table,
+        [
+            {'metric': 'help_users', 'manual_value': 12847, **_common},
+            {'metric': 'total_compares', 'manual_value': 86532, **_common},
+            {'metric': 'total_saved', 'manual_value': 3762140, **_common},  # 37621.40 元
+        ],
+    )
+
+
+def downgrade() -> None:
+    op.drop_table('platform_stat_display')

alembic/versions/platform_stat_growth_offset.py

@@ -0,0 +1,39 @@
+"""platform_stat_display 增强:绝对增量增长 / 真实值偏移 / 只增不减护栏
+
+给首页三统计配置加 5 列:
+- random_kind ('mult'/'add') + random_step_min/max:自增长支持「绝对增量」(每周期 +[a,b]),不只是 ×倍率
+- real_offset:真实值模式基数偏移(展示=真实+偏移,冷启动既真实又体面)
+- allow_decrease:门面数字默认「只增不减」,开此开关才允许展示值下降
+
+Revision ID: pstat3growth
+Revises: marquee_seed02
+Create Date: 2026-06-07 12:00:00.000000
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = 'pstat3growth'
+down_revision: Union[str, Sequence[str], None] = 'marquee_seed02'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('platform_stat_display', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('random_kind', sa.String(length=8), nullable=False, server_default='mult'))
+        batch_op.add_column(sa.Column('random_step_min', sa.Integer(), nullable=False, server_default='0'))
+        batch_op.add_column(sa.Column('random_step_max', sa.Integer(), nullable=False, server_default='0'))
+        batch_op.add_column(sa.Column('real_offset', sa.Integer(), nullable=False, server_default='0'))
+        batch_op.add_column(sa.Column('allow_decrease', sa.Boolean(), nullable=False, server_default=sa.false()))
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('platform_stat_display', schema=None) as batch_op:
+        batch_op.drop_column('allow_decrease')
+        batch_op.drop_column('real_offset')
+        batch_op.drop_column('random_step_max')
+        batch_op.drop_column('random_step_min')
+        batch_op.drop_column('random_kind')

alembic/versions/price_observation_table.py

@@ -0,0 +1,74 @@
+"""price_observation table (价格观测:比价沉淀的价格资产层,server 侧无条件落库)
+
+Revision ID: price_observation_table
+Revises: wx_transfer_auth
+Create Date: 2026-06-07 00:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'price_observation_table'
+down_revision: Union[str, Sequence[str], None] = 'wx_transfer_auth'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'price_observation',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('observed_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.Column('trace_id', sa.String(length=64), nullable=False),
+        sa.Column('business_type', sa.String(length=16), nullable=False),
+        sa.Column('platform', sa.String(length=32), nullable=False),
+        sa.Column('platform_store_id', sa.String(length=64), nullable=True),
+        sa.Column('store_name', sa.String(length=128), nullable=True),
+        sa.Column('city', sa.String(length=64), nullable=True),
+        sa.Column('geohash', sa.String(length=16), nullable=True),
+        sa.Column('lng', sa.Float(), nullable=True),
+        sa.Column('lat', sa.Float(), nullable=True),
+        sa.Column('is_source', sa.Boolean(), nullable=False),
+        sa.Column('scope', sa.String(length=16), nullable=False),
+        sa.Column('price_cents', sa.Integer(), nullable=True),
+        sa.Column('coupon_saved_cents', sa.Integer(), nullable=True),
+        sa.Column('coupon_name', sa.String(length=64), nullable=True),
+        sa.Column('store_closed', sa.String(length=32), nullable=True),
+        sa.Column('rank', sa.Integer(), nullable=True),
+        # PG 上为 JSONB,其它(SQLite)为 JSON——与模型层 with_variant 对齐
+        sa.Column('dishes', sa.JSON().with_variant(sa.dialects.postgresql.JSONB(), 'postgresql'), nullable=True),
+        sa.Column('attrs', sa.JSON().with_variant(sa.dialects.postgresql.JSONB(), 'postgresql'), nullable=True),
+        sa.Column('source_device_id', sa.String(length=64), nullable=True),
+        sa.Column('source_user_id', sa.Integer(), nullable=True),
+        sa.Column('confidence', sa.Float(), nullable=False),
+        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.PrimaryKeyConstraint('id'),
+        sa.UniqueConstraint('trace_id', 'platform', 'scope', name='uq_price_obs_trace_platform_scope'),
+    )
+    with op.batch_alter_table('price_observation', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_price_observation_observed_at'), ['observed_at'], unique=False)
+        batch_op.create_index(batch_op.f('ix_price_observation_trace_id'), ['trace_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_price_observation_business_type'), ['business_type'], unique=False)
+        batch_op.create_index(batch_op.f('ix_price_observation_platform'), ['platform'], unique=False)
+        batch_op.create_index(batch_op.f('ix_price_observation_store_name'), ['store_name'], unique=False)
+        batch_op.create_index(batch_op.f('ix_price_observation_geohash'), ['geohash'], unique=False)
+        batch_op.create_index(batch_op.f('ix_price_observation_source_device_id'), ['source_device_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_price_observation_source_user_id'), ['source_user_id'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('price_observation', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_price_observation_source_user_id'))
+        batch_op.drop_index(batch_op.f('ix_price_observation_source_device_id'))
+        batch_op.drop_index(batch_op.f('ix_price_observation_geohash'))
+        batch_op.drop_index(batch_op.f('ix_price_observation_store_name'))
+        batch_op.drop_index(batch_op.f('ix_price_observation_platform'))
+        batch_op.drop_index(batch_op.f('ix_price_observation_business_type'))
+        batch_op.drop_index(batch_op.f('ix_price_observation_trace_id'))
+        batch_op.drop_index(batch_op.f('ix_price_observation_observed_at'))
+
+    op.drop_table('price_observation')

alembic/versions/savings_report_fields.py

@@ -0,0 +1,49 @@
+"""savings_record:真实比价上报字段 + (user_id, client_event_id) 幂等唯一约束
+
+把 savings_record 升级为「记账唯一真相表」:真实上报(source='compare')写入
+原价/比价价/支付渠道/平台包名/源平台名/源链接/幂等键/device_id;
+demo seeder 行(source='demo')这些列均为 NULL。
+
+Revision ID: savings_report_fields
+Revises: f01db5d77dac
+Create Date: 2026-05-31 19:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'savings_report_fields'
+down_revision: Union[str, Sequence[str], None] = 'f01db5d77dac'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('savings_record', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('original_price_cents', sa.Integer(), nullable=True))
+        batch_op.add_column(sa.Column('compared_price_cents', sa.Integer(), nullable=True))
+        batch_op.add_column(sa.Column('pay_channel', sa.String(length=16), nullable=True))
+        batch_op.add_column(sa.Column('platform_package', sa.String(length=128), nullable=True))
+        batch_op.add_column(sa.Column('source_platform_name', sa.String(length=32), nullable=True))
+        batch_op.add_column(sa.Column('source_deeplink', sa.String(length=512), nullable=True))
+        batch_op.add_column(sa.Column('client_event_id', sa.String(length=64), nullable=True))
+        batch_op.add_column(sa.Column('device_id', sa.String(length=128), nullable=True))
+        # (user_id, client_event_id) 幂等;demo 行 client_event_id 为 NULL 不冲突
+        batch_op.create_unique_constraint('uq_savings_user_event', ['user_id', 'client_event_id'])
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('savings_record', schema=None) as batch_op:
+        batch_op.drop_constraint('uq_savings_user_event', type_='unique')
+        batch_op.drop_column('device_id')
+        batch_op.drop_column('client_event_id')
+        batch_op.drop_column('source_deeplink')
+        batch_op.drop_column('source_platform_name')
+        batch_op.drop_column('platform_package')
+        batch_op.drop_column('pay_channel')
+        batch_op.drop_column('compared_price_cents')
+        batch_op.drop_column('original_price_cents')

alembic/versions/store_mapping_jd_cols.py

@@ -0,0 +1,40 @@
+"""store_mapping 加京东原料列(jd_vender_id + 分享链/反查 URL/deeplink)
+
+Revision ID: store_mapping_jd_cols
+Revises: store_mapping_meituan_cols
+Create Date: 2026-06-13 00:00:00.000000
+
+京东秒送接入店内搜索 deeplink 链路: 3.cn 短链 → 跟随重定向反查 venderId+storeId →
+openapp.jdmobile:// deeplink。京东店铺身份是**两个**稳定数字 id: storeId 进 id_jd(稳定
+店主键, 同 taobao 的 shopId→id_taobao), venderId 进单列 jd_vender_id(deeplink 还需它)。
+其余三列与 taobao_*/meituan_* 原料列平行。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'store_mapping_jd_cols'
+down_revision: Union[str, Sequence[str], None] = 'store_mapping_meituan_cols'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('jd_vender_id', sa.String(length=64), nullable=True))
+        batch_op.add_column(sa.Column('jd_share_url', sa.String(length=256), nullable=True))
+        batch_op.add_column(sa.Column('jd_resolved_url', sa.Text(), nullable=True))
+        batch_op.add_column(sa.Column('jd_deeplink', sa.Text(), nullable=True))
+        batch_op.create_index(batch_op.f('ix_store_mapping_jd_vender_id'), ['jd_vender_id'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_store_mapping_jd_vender_id'))
+        batch_op.drop_column('jd_deeplink')
+        batch_op.drop_column('jd_resolved_url')
+        batch_op.drop_column('jd_share_url')
+        batch_op.drop_column('jd_vender_id')

alembic/versions/store_mapping_meituan_cols.py

@@ -0,0 +1,39 @@
+"""store_mapping 加美团原料列(poi_id_str + 分享链/反查 URL/deeplink)
+
+Revision ID: store_mapping_meituan_cols
+Revises: store_mapping_table
+Create Date: 2026-06-13 00:00:00.000000
+
+美团接入店内搜索 deeplink 链路: dpurl.cn 短链 → 302 反查 poi_id_str → imeituan:// deeplink。
+poi_id_str 每次分享重新加密、非稳定主键, 单列 meituan_poi_id_str 存(不占 id_meituan,
+后者留给将来 CPS API 的稳定数字 poi_id)。其余三列与 taobao_* 原料列平行。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'store_mapping_meituan_cols'
+down_revision: Union[str, Sequence[str], None] = 'store_mapping_table'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('meituan_poi_id_str', sa.String(length=64), nullable=True))
+        batch_op.add_column(sa.Column('meituan_share_url', sa.String(length=256), nullable=True))
+        batch_op.add_column(sa.Column('meituan_resolved_url', sa.Text(), nullable=True))
+        batch_op.add_column(sa.Column('meituan_deeplink', sa.Text(), nullable=True))
+        batch_op.create_index(batch_op.f('ix_store_mapping_meituan_poi_id_str'), ['meituan_poi_id_str'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_store_mapping_meituan_poi_id_str'))
+        batch_op.drop_column('meituan_deeplink')
+        batch_op.drop_column('meituan_resolved_url')
+        batch_op.drop_column('meituan_share_url')
+        batch_op.drop_column('meituan_poi_id_str')

alembic/versions/store_mapping_table.py

@@ -0,0 +1,77 @@
+"""store_mapping table (平台店铺表:跨平台同店 id/名 映射,server 侧无条件落库)
+
+Revision ID: store_mapping_table
+Revises: coin_txn_task_ref_uq
+Create Date: 2026-06-13 00:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'store_mapping_table'
+down_revision: Union[str, Sequence[str], None] = 'coin_txn_task_ref_uq'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'store_mapping',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        # 跨平台身份
+        sa.Column('id_taobao', sa.String(length=64), nullable=True),
+        sa.Column('name_taobao', sa.String(length=128), nullable=True),
+        sa.Column('id_meituan', sa.String(length=64), nullable=True),
+        sa.Column('name_meituan', sa.String(length=128), nullable=True),
+        sa.Column('id_jd', sa.String(length=64), nullable=True),
+        sa.Column('name_jd', sa.String(length=128), nullable=True),
+        # 地理
+        sa.Column('city', sa.String(length=64), nullable=True),
+        sa.Column('geohash', sa.String(length=16), nullable=True),
+        sa.Column('lng', sa.Float(), nullable=True),
+        sa.Column('lat', sa.Float(), nullable=True),
+        sa.Column('taobao_address', sa.String(length=256), nullable=True),
+        # 溯源
+        sa.Column('source_platform', sa.String(length=32), nullable=True),
+        sa.Column('business_type', sa.String(length=16), nullable=False),
+        sa.Column('trace_id', sa.String(length=64), nullable=False),
+        sa.Column('source_device_id', sa.String(length=64), nullable=True),
+        sa.Column('source_user_id', sa.Integer(), nullable=True),
+        # 淘宝原料(URL 可能很长 → Text)
+        sa.Column('taobao_share_url', sa.String(length=256), nullable=True),
+        sa.Column('taobao_resolved_url', sa.Text(), nullable=True),
+        sa.Column('taobao_deeplink', sa.Text(), nullable=True),
+        # PG 上为 JSONB,其它(SQLite)为 JSON——与模型层 with_variant 对齐
+        sa.Column('attrs', sa.JSON().with_variant(sa.dialects.postgresql.JSONB(), 'postgresql'), nullable=True),
+        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.PrimaryKeyConstraint('id'),
+        # 一次比价一行,trace_id 幂等去重(防 pricebot 重试 / replay 重复写)
+        sa.UniqueConstraint('trace_id', name='uq_store_mapping_trace'),
+    )
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_store_mapping_id_taobao'), ['id_taobao'], unique=False)
+        batch_op.create_index(batch_op.f('ix_store_mapping_id_meituan'), ['id_meituan'], unique=False)
+        batch_op.create_index(batch_op.f('ix_store_mapping_id_jd'), ['id_jd'], unique=False)
+        batch_op.create_index(batch_op.f('ix_store_mapping_geohash'), ['geohash'], unique=False)
+        batch_op.create_index(batch_op.f('ix_store_mapping_source_platform'), ['source_platform'], unique=False)
+        batch_op.create_index(batch_op.f('ix_store_mapping_source_device_id'), ['source_device_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_store_mapping_source_user_id'), ['source_user_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_store_mapping_created_at'), ['created_at'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_store_mapping_created_at'))
+        batch_op.drop_index(batch_op.f('ix_store_mapping_source_user_id'))
+        batch_op.drop_index(batch_op.f('ix_store_mapping_source_device_id'))
+        batch_op.drop_index(batch_op.f('ix_store_mapping_source_platform'))
+        batch_op.drop_index(batch_op.f('ix_store_mapping_geohash'))
+        batch_op.drop_index(batch_op.f('ix_store_mapping_id_jd'))
+        batch_op.drop_index(batch_op.f('ix_store_mapping_id_meituan'))
+        batch_op.drop_index(batch_op.f('ix_store_mapping_id_taobao'))
+
+    op.drop_table('store_mapping')

alembic/versions/user_force_onboarding.py

@@ -0,0 +1,39 @@
+"""add user.force_onboarding
+
+运营后台「一键开启新手引导」:置 true → 用户下次启动 App 被强制重走引导教程(即便本地已完成),
+走完引导(/api/v1/user/onboarding/complete)后端自动清回 false,不无限循环。
+见 app/models/user.py force_onboarding 列、admin POST /admin/api/users/{id}/force-onboarding。
+
+Revision ID: user_force_onboarding
+Revises: onboarding_completion
+Create Date: 2026-06-10 21:30:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = "user_force_onboarding"
+down_revision: Union[str, Sequence[str], None] = "onboarding_completion"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # sa.false() 渲染成 PG 的 false / SQLite 的 0,两端兼容(同 debug_trace_enabled)。
+    op.add_column(
+        "user",
+        sa.Column(
+            "force_onboarding",
+            sa.Boolean(),
+            nullable=False,
+            server_default=sa.false(),
+        ),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("user", "force_onboarding")

alembic/versions/wechat_transfer_authorization.py

@@ -0,0 +1,48 @@
+"""wechat_transfer_authorization 表(免确认收款授权)
+
+商家转账「用户授权免确认收款模式」:用户授权一次后,后续提现免逐笔确认直接到账。
+一个用户一条(user_id 主键)。out_authorization_no 我方生成,authorization_id 微信 active 后返回。
+
+Revision ID: wx_transfer_auth
+Revises: withdraw_review_ad_watch
+Create Date: 2026-06-06 12:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'wx_transfer_auth'
+down_revision: Union[str, Sequence[str], None] = 'withdraw_review_ad_watch'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'wechat_transfer_authorization',
+        sa.Column('user_id', sa.Integer(), nullable=False),
+        sa.Column('openid', sa.String(length=64), nullable=False),
+        sa.Column('out_authorization_no', sa.String(length=64), nullable=False),
+        sa.Column('authorization_id', sa.String(length=64), nullable=True),
+        sa.Column('state', sa.String(length=16), server_default='pending', nullable=False),
+        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.Column('updated_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.ForeignKeyConstraint(['user_id'], ['user.id'], ),
+        sa.PrimaryKeyConstraint('user_id'),
+    )
+    with op.batch_alter_table('wechat_transfer_authorization', schema=None) as batch_op:
+        batch_op.create_index(
+            batch_op.f('ix_wechat_transfer_authorization_out_authorization_no'),
+            ['out_authorization_no'],
+            unique=True,
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('wechat_transfer_authorization', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_wechat_transfer_authorization_out_authorization_no'))
+    op.drop_table('wechat_transfer_authorization')

alembic/versions/withdraw_review_and_ad_watch.py

@@ -0,0 +1,62 @@
+"""withdraw_order.user_name 列 + ad_watch_log 表
+
+提现审核功能:WithdrawOrder 加 user_name(审核异步打款时传给微信的实名,达额转账要求)。
+看广告时长防刷:新增 ad_watch_log 表(前端 onAdClose 上报观看秒数,按 (user_id, watch_date)
+聚合做"每天 50 分钟"硬上限)。
+
+Revision ID: withdraw_review_ad_watch
+Revises: ebb6af5c0b56
+Create Date: 2026-06-05 12:00:00.000000
+
+注:本迁移原 down_revision=ad60a1b2c3d4(分支创建时的 head);rebase 合 main 后 main 侧已新增
+app_config / price_report 等迁移并 merge 出 head=ebb6af5c0b56,故改挂到其上,保持单 head(本迁移
+与那些表互不相干,叠加顺序无影响)。
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'withdraw_review_ad_watch'
+down_revision: Union[str, Sequence[str], None] = 'ebb6af5c0b56'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # ① 提现单加实名列:审核通过后异步打款时传给微信(达额转账要求),发起提现时存下
+    with op.batch_alter_table('withdraw_order', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('user_name', sa.String(length=64), nullable=True))
+
+    # ② 看广告观看时长表:前端上报观看秒数,(user_id, watch_date) 聚合做每日 50 分钟防刷主闸
+    op.create_table(
+        'ad_watch_log',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('user_id', sa.Integer(), nullable=False),
+        sa.Column('watch_seconds', sa.Integer(), server_default='0', nullable=False),
+        sa.Column('watch_date', sa.String(length=10), nullable=False),
+        sa.Column(
+            'created_at', sa.DateTime(timezone=True),
+            server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False,
+        ),
+        sa.ForeignKeyConstraint(['user_id'], ['user.id'], ),
+        sa.PrimaryKeyConstraint('id'),
+    )
+    with op.batch_alter_table('ad_watch_log', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_ad_watch_log_user_id'), ['user_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_ad_watch_log_watch_date'), ['watch_date'], unique=False)
+        batch_op.create_index(batch_op.f('ix_ad_watch_log_created_at'), ['created_at'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('ad_watch_log', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_ad_watch_log_created_at'))
+        batch_op.drop_index(batch_op.f('ix_ad_watch_log_watch_date'))
+        batch_op.drop_index(batch_op.f('ix_ad_watch_log_user_id'))
+    op.drop_table('ad_watch_log')
+
+    with op.batch_alter_table('withdraw_order', schema=None) as batch_op:
+        batch_op.drop_column('user_name')

alembic/versions/withdraw_safety_indexes.py

@@ -0,0 +1,42 @@
+"""add withdraw concurrency safety indexes
+
+Revision ID: withdraw_safety_indexes
+Revises: 0cf18d590b1d
+Create Date: 2026-06-08 16:20:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = "withdraw_safety_indexes"
+down_revision: Union[str, Sequence[str], None] = "0cf18d590b1d"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_index(
+        "ux_withdraw_order_user_active",
+        "withdraw_order",
+        ["user_id"],
+        unique=True,
+        sqlite_where=sa.text("status IN ('reviewing', 'pending')"),
+        postgresql_where=sa.text("status IN ('reviewing', 'pending')"),
+    )
+    op.create_index(
+        "ux_cash_transaction_withdraw_refund_ref",
+        "cash_transaction",
+        ["ref_id"],
+        unique=True,
+        sqlite_where=sa.text("biz_type = 'withdraw_refund' AND ref_id IS NOT NULL"),
+        postgresql_where=sa.text("biz_type = 'withdraw_refund' AND ref_id IS NOT NULL"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ux_cash_transaction_withdraw_refund_ref", table_name="cash_transaction")
+    op.drop_index("ux_withdraw_order_user_active", table_name="withdraw_order")

app/admin/__init__.py

@@ -0,0 +1,6 @@
+"""运营 Admin 后台子应用。
+
+独立 FastAPI app(app.admin.main:admin_app),独立进程/端口运行,复用 App 的
+models/repositories/integrations + 同一个 DB,但鉴权完全隔离(独立 JWT secret)。
+现有 app.main:app 不 import 本包,admin 崩溃不影响 App 主进程。
+"""

app/admin/audit.py

@@ -0,0 +1,38 @@
+"""审计写入门面。
+
+每个 admin 写操作调一次 write_audit,把"谁(admin)在哪个 IP 对什么(target)做了什么
+(action)+ 前后值(detail)"落进 admin_audit_log。
+
+⚠️ 涉钱/涉状态的写操作:传 commit=False,和业务写操作放同一事务一起 commit,
+保证"改了就有痕、有痕就改了"原子(见 plan 风险点 1)。轻量操作可 commit=True。
+"""
+from __future__ import annotations
+
+from sqlalchemy.orm import Session
+
+from app.admin.repositories import audit_log as audit_repo
+from app.models.admin import AdminUser
+
+
+def write_audit(
+    db: Session,
+    admin: AdminUser,
+    *,
+    action: str,
+    target_type: str,
+    target_id: str | int | None = None,
+    detail: dict | None = None,
+    ip: str | None = None,
+    commit: bool = True,
+) -> None:
+    audit_repo.add_audit_log(
+        db,
+        admin_id=admin.id,
+        admin_username=admin.username,
+        action=action,
+        target_type=target_type,
+        target_id=str(target_id) if target_id is not None else None,
+        detail=detail,
+        ip=ip,
+        commit=commit,
+    )

app/admin/deps.py

@@ -0,0 +1,84 @@
+"""Admin API 共享依赖:DB session、当前 admin、角色守卫、客户端 IP。
+
+仿 app/api/deps.py 的 get_current_user,但验的是独立的 admin JWT、查的是 admin_user 表。
+"""
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import Depends, HTTPException, Request, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from sqlalchemy.orm import Session
+
+from app.admin.repositories import admin_user as admin_repo
+from app.admin.security import AdminTokenError, decode_admin_token
+from app.db.session import get_db
+from app.models.admin import AdminUser
+
+_bearer = HTTPBearer(auto_error=False, scheme_name="AdminBearer")
+
+
+def get_current_admin(
+    credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(_bearer)],
+    db: Annotated[Session, Depends(get_db)],
+) -> AdminUser:
+    """从 Authorization: Bearer <admin_token> 解出当前管理员。失败统一 401。"""
+    if credentials is None or credentials.scheme.lower() != "bearer":
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="missing bearer token",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    try:
+        payload = decode_admin_token(credentials.credentials)
+    except AdminTokenError as e:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=str(e),
+            headers={"WWW-Authenticate": "Bearer"},
+        ) from e
+
+    admin = admin_repo.get_by_id(db, int(payload["sub"]))
+    if admin is None or admin.status != "active":
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="admin not found or disabled",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    return admin
+
+
+CurrentAdmin = Annotated[AdminUser, Depends(get_current_admin)]
+AdminDb = Annotated[Session, Depends(get_db)]
+
+
+def require_role(*roles: str):
+    """角色守卫依赖工厂。super_admin 恒通过(全权)。
+
+    用法:在路由签名加 `_: Annotated[AdminUser, Depends(require_role("finance"))]`,
+    或 `dependencies=[Depends(require_role("finance"))]`(不需要拿 admin 时)。
+    """
+    allowed = set(roles)
+
+    def _checker(admin: CurrentAdmin) -> AdminUser:
+        if admin.role != "super_admin" and admin.role not in allowed:
+            need = sorted(allowed | {"super_admin"})
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail=f"role '{admin.role}' not allowed (need one of {need})",
+            )
+        return admin
+
+    return _checker
+
+
+def get_client_ip(request: Request) -> str:
+    """取客户端 IP(审计日志用)。生产经 nginx 反代,优先 X-Forwarded-For 第一段;否则直连 IP。
+
+    ⚠️ XFF 可被客户端伪造。nginx 必须用 `proxy_set_header X-Forwarded-For $remote_addr`
+    覆盖客户端传入值(见 M4 部署),否则审计里的 IP 可被伪造。审计 IP 仅作记录、不参与鉴权。
+    """
+    xff = request.headers.get("x-forwarded-for")
+    if xff:
+        return xff.split(",")[0].strip()
+    return request.client.host if request.client else ""

app/admin/main.py

@@ -0,0 +1,92 @@
+"""Admin 后台 FastAPI app(独立进程)。
+
+启动:uvicorn app.admin.main:admin_app --host 127.0.0.1 --port 8771
+复用 App 的 DB/models/repositories/integrations;鉴权独立(admin JWT,见 app/admin/security.py)。
+现有 app.main:app 不 import 本模块,两进程互不影响。
+"""
+from __future__ import annotations
+
+import logging
+from collections.abc import AsyncIterator
+from contextlib import asynccontextmanager
+
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+
+from app.admin.routers.ad_audit import router as ad_audit_router
+from app.admin.routers.admins import router as admins_router
+from app.admin.routers.audit import router as audit_router
+from app.admin.routers.auth import router as auth_router
+from app.admin.routers.config import router as config_router
+from app.admin.routers.dashboard import router as dashboard_router
+from app.admin.routers.ops_stat_config import router as ops_stat_config_router
+from app.admin.routers.feedback import router as feedback_router
+from app.admin.routers.onboarding import router as onboarding_router
+from app.admin.routers.ops_marquee_seed import router as ops_marquee_seed_router
+from app.admin.routers.price_report import router as price_report_router
+from app.admin.routers.users import router as users_router
+from app.admin.routers.wallet import router as wallet_router
+from app.admin.routers.withdraw import router as withdraw_router
+from app.core.config import settings
+from app.core.logging import setup_logging
+
+setup_logging(debug=settings.APP_DEBUG)
+logger = logging.getLogger("shagua.admin")
+
+
+@asynccontextmanager
+async def lifespan(_: FastAPI) -> AsyncIterator[None]:
+    logger.info(
+        "admin app started env=%s db=%s",
+        settings.APP_ENV,
+        settings.DATABASE_URL.split("://", 1)[0],
+    )
+    yield
+    logger.info("admin app shutting down")
+
+
+admin_app = FastAPI(
+    title=f"{settings.APP_NAME} · Admin",
+    version="0.1.0",
+    docs_url="/admin/docs" if not settings.is_prod else None,
+    redoc_url=None,
+    lifespan=lifespan,
+)
+
+# admin 前端独立部署。生产同域(nginx)无需 CORS;本地 next dev 跨域需放行开发源。
+_dev_origins = [
+    "http://localhost:3001",
+    "http://127.0.0.1:3001",
+    "http://localhost:3000",
+    "http://127.0.0.1:3000",
+]
+_origins = settings.cors_origins_list or ([] if settings.is_prod else _dev_origins)
+if _origins:
+    admin_app.add_middleware(
+        CORSMiddleware,
+        allow_origins=_origins,
+        allow_credentials=True,
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
+
+
+@admin_app.get("/admin/api/health", tags=["meta"])
+def health() -> dict[str, str]:
+    return {"status": "ok", "service": "admin"}
+
+
+admin_app.include_router(auth_router)
+admin_app.include_router(dashboard_router)
+admin_app.include_router(ops_stat_config_router)
+admin_app.include_router(ops_marquee_seed_router)
+admin_app.include_router(users_router)
+admin_app.include_router(onboarding_router)
+admin_app.include_router(wallet_router)
+admin_app.include_router(withdraw_router)
+admin_app.include_router(price_report_router)
+admin_app.include_router(feedback_router)
+admin_app.include_router(admins_router)
+admin_app.include_router(audit_router)
+admin_app.include_router(config_router)
+admin_app.include_router(ad_audit_router)

app/admin/repositories/__init__.py

@@ -0,0 +1 @@
+"""admin 专用数据访问层(跨用户查询 + admin 账号 + 审计 + 大盘聚合)。"""

app/admin/repositories/ad_audit.py

@@ -0,0 +1,228 @@
+"""看广告金币审计:复算 expected_coin 并与实发对比。
+
+只读。复用 [app.core.rewards] 的公式函数(不另写公式,避免与正式发奖口径漂移):
+- 看视频:每条 granted = 1 份,第 N 份 = 该用户 granted 的 reward_video **账号累计**顺序号
+  (与 ad_reward.grant_ad_reward 里 `_granted_cumulative + 1` 一致;LT 因子不按天重置,
+  故复算时要把当日序号叠加上该用户在本日**之前**的累计已发份数)。
+- 信息流:每条按 unit_count 份逐份累加,LT 序号 = 该用户 granted 份数**账号累计**
+  (与 ad_feed_reward._unit_reward_total 的 existing_units 一致;同样不按天重置,
+  复算需叠加本日之前的累计份数)。
+
+非 granted(capped/ecpm_missing)不占用份序号、应发恒 0,据此校验闸口是否确实没发。
+"""
+from __future__ import annotations
+
+from sqlalchemy import func, select
+from sqlalchemy.orm import Session
+
+from app.core import rewards
+from app.models.ad_feed_reward import AdFeedRewardRecord
+from app.models.ad_reward import AdRewardRecord
+from app.repositories.ad_feed_reward import FEED_REWARD_UNIT_SECONDS
+
+
+def _prior_granted_counts(
+    db: Session, *, date: str, user_id: int | None
+) -> dict[int, int]:
+    """各用户在 date **之前**已发奖的 reward_video 累计份数,作为当日复算的 LT 序号起点。
+    LT 因子改账号累计后,当日第 1 份并非全局第 1 份,需叠加历史累计。"""
+    stmt = (
+        select(AdRewardRecord.user_id, func.count())
+        .where(
+            AdRewardRecord.reward_date < date,
+            AdRewardRecord.reward_scene == "reward_video",
+            AdRewardRecord.status == "granted",
+        )
+        .group_by(AdRewardRecord.user_id)
+    )
+    if user_id is not None:
+        stmt = stmt.where(AdRewardRecord.user_id == user_id)
+    return {uid: n for uid, n in db.execute(stmt).all()}
+
+
+def _reward_video_rows(
+    db: Session, *, date: str, user_id: int | None
+) -> list[dict]:
+    """看视频记录复算。按 (user_id, created_at) 升序还原账号累计第 N 份(含本日之前的累计)。"""
+    stmt = (
+        select(AdRewardRecord)
+        .where(
+            AdRewardRecord.reward_date == date,
+            AdRewardRecord.reward_scene == "reward_video",
+        )
+        .order_by(AdRewardRecord.user_id, AdRewardRecord.created_at, AdRewardRecord.id)
+    )
+    if user_id is not None:
+        stmt = stmt.where(AdRewardRecord.user_id == user_id)
+
+    # 用本日之前的累计份数做起点,当日 granted 在其上继续递增 → 与 _granted_cumulative+1 对齐
+    granted_n: dict[int, int] = _prior_granted_counts(db, date=date, user_id=user_id)
+    rows: list[dict] = []
+    for rec in db.execute(stmt).scalars():
+        if rec.status == "granted":
+            nth = granted_n.get(rec.user_id, 0) + 1
+            granted_n[rec.user_id] = nth
+            expected = rewards.calculate_ad_reward_coin(rec.ecpm_raw, nth)
+            rows.append({
+                "scene": "reward_video",
+                "record_id": rec.id,
+                "user_id": rec.user_id,
+                "created_at": rec.created_at,
+                "status": rec.status,
+                "ecpm": rec.ecpm_raw,
+                "ecpm_factor": rewards.ad_ecpm_factor(rewards.parse_ecpm_yuan(rec.ecpm_raw)),
+                "units": 1,
+                "lt_index_start": nth,
+                "lt_index_end": nth,
+                "lt_factor_start": rewards.ad_lt_factor(nth),
+                "lt_factor_end": rewards.ad_lt_factor(nth),
+                "expected_coin": expected,
+                "actual_coin": rec.coin,
+                "matched": expected == rec.coin,
+            })
+        else:
+            # capped / ecpm_missing:不发金币,校验实发确为 0
+            rows.append({
+                "scene": "reward_video",
+                "record_id": rec.id,
+                "user_id": rec.user_id,
+                "created_at": rec.created_at,
+                "status": rec.status,
+                "ecpm": rec.ecpm_raw,
+                "ecpm_factor": None,
+                "units": 1,
+                "lt_index_start": None,
+                "lt_index_end": None,
+                "lt_factor_start": None,
+                "lt_factor_end": None,
+                "expected_coin": 0,
+                "actual_coin": rec.coin,
+                "matched": rec.coin == 0,
+            })
+    return rows
+
+
+def _feed_prior_granted_units(
+    db: Session, *, date: str, user_id: int | None
+) -> dict[int, int]:
+    """各用户在 date **之前** granted 的信息流份数累计,作为当日复算的 LT 序号起点。"""
+    stmt = (
+        select(
+            AdFeedRewardRecord.user_id,
+            func.coalesce(func.sum(AdFeedRewardRecord.unit_count), 0),
+        )
+        .where(
+            AdFeedRewardRecord.reward_date < date,
+            AdFeedRewardRecord.status == "granted",
+        )
+        .group_by(AdFeedRewardRecord.user_id)
+    )
+    if user_id is not None:
+        stmt = stmt.where(AdFeedRewardRecord.user_id == user_id)
+    return {uid: int(n) for uid, n in db.execute(stmt).all()}
+
+
+def _feed_rows(db: Session, *, date: str, user_id: int | None) -> list[dict]:
+    """信息流记录复算。granted 记录逐份累加,LT 序号沿用账号累计份数(含本日之前)。"""
+    stmt = (
+        select(AdFeedRewardRecord)
+        .where(AdFeedRewardRecord.reward_date == date)
+        .order_by(AdFeedRewardRecord.user_id, AdFeedRewardRecord.created_at, AdFeedRewardRecord.id)
+    )
+    if user_id is not None:
+        stmt = stmt.where(AdFeedRewardRecord.user_id == user_id)
+
+    # 本日之前的累计份数做起点,与 _unit_reward_total 的 existing_units(累计)对齐
+    granted_units: dict[int, int] = _feed_prior_granted_units(db, date=date, user_id=user_id)
+    rows: list[dict] = []
+    for rec in db.execute(stmt).scalars():
+        if rec.status == "granted":
+            existing = granted_units.get(rec.user_id, 0)
+            units = rec.unit_count
+            expected = sum(
+                rewards.calculate_ad_reward_coin(rec.ecpm_raw, existing + offset)
+                for offset in range(1, units + 1)
+            )
+            granted_units[rec.user_id] = existing + units
+            start = existing + 1 if units > 0 else None
+            end = existing + units if units > 0 else None
+            rows.append({
+                "scene": "feed",
+                "record_id": rec.id,
+                "user_id": rec.user_id,
+                "created_at": rec.created_at,
+                "status": rec.status,
+                "ecpm": rec.ecpm_raw,
+                "ecpm_factor": rewards.ad_ecpm_factor(rewards.parse_ecpm_yuan(rec.ecpm_raw)),
+                "units": units,
+                "lt_index_start": start,
+                "lt_index_end": end,
+                "lt_factor_start": rewards.ad_lt_factor(start) if start else None,
+                "lt_factor_end": rewards.ad_lt_factor(end) if end else None,
+                "expected_coin": expected,
+                "actual_coin": rec.coin,
+                "matched": expected == rec.coin,
+            })
+        else:
+            rows.append({
+                "scene": "feed",
+                "record_id": rec.id,
+                "user_id": rec.user_id,
+                "created_at": rec.created_at,
+                "status": rec.status,
+                "ecpm": rec.ecpm_raw,
+                "ecpm_factor": None,
+                "units": rec.unit_count,
+                "lt_index_start": None,
+                "lt_index_end": None,
+                "lt_factor_start": None,
+                "lt_factor_end": None,
+                "expected_coin": 0,
+                "actual_coin": rec.coin,
+                "matched": rec.coin == 0,
+            })
+    return rows
+
+
+def ad_coin_audit(
+    db: Session,
+    *,
+    date: str,
+    user_id: int | None,
+    scene: str | None,
+    limit: int,
+    only_mismatch: bool = False,
+) -> dict:
+    """当日发奖复算。返回 {total, mismatch_count, truncated, items}。
+
+    scene: None=两类都要 / "reward_video" / "feed";only_mismatch=True 只展示不一致(✗)行。
+    关键:`total` 与 `mismatch_count` 在**全量**(截断前)上统计,故对账数字始终可信,不受 limit
+    影响;`items` 才是展示集(only_mismatch 时只取 ✗ 行)按 created_at 倒序截断到 limit。
+    份序号在全天数据上已算好,limit 只影响展示条数、不影响 expected 复算正确性。
+    """
+    rows: list[dict] = []
+    if scene in (None, "reward_video"):
+        rows.extend(_reward_video_rows(db, date=date, user_id=user_id))
+    if scene in (None, "feed"):
+        rows.extend(_feed_rows(db, date=date, user_id=user_id))
+    rows.sort(key=lambda r: (r["created_at"], r["record_id"]), reverse=True)
+
+    total = len(rows)
+    mismatch_count = sum(1 for r in rows if not r["matched"])
+    display = [r for r in rows if not r["matched"]] if only_mismatch else rows
+    return {
+        "total": total,
+        "mismatch_count": mismatch_count,
+        "truncated": len(display) > limit,
+        "items": display[:limit],
+    }
+
+
+def formula_snapshot() -> dict:
+    """当前公式参数快照(给前端展示规则参照)。直接读 rewards 常量,与发奖同源。"""
+    return {
+        "coin_per_yuan": rewards.COIN_PER_YUAN,
+        "feed_unit_seconds": FEED_REWARD_UNIT_SECONDS,
+        "ecpm_factor_tiers": [list(t) for t in rewards.AD_ECPM_FACTOR_TABLE],
+        "lt_factor_tiers": [list(t) for t in rewards.AD_LT_FACTOR_TABLE],
+    }

app/admin/repositories/admin_user.py

@@ -0,0 +1,64 @@
+"""admin_user 表 CRUD。"""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.core.security import hash_password
+from app.models.admin import AdminUser
+
+
+def get_by_id(db: Session, admin_id: int) -> AdminUser | None:
+    return db.get(AdminUser, admin_id)
+
+
+def get_by_username(db: Session, username: str) -> AdminUser | None:
+    stmt = select(AdminUser).where(AdminUser.username == username)
+    return db.execute(stmt).scalar_one_or_none()
+
+
+def create_admin(
+    db: Session, *, username: str, password: str, role: str = "operator"
+) -> AdminUser:
+    admin = AdminUser(
+        username=username,
+        password_hash=hash_password(password),
+        role=role,
+    )
+    db.add(admin)
+    db.commit()
+    db.refresh(admin)
+    return admin
+
+
+def update_last_login(db: Session, admin: AdminUser) -> None:
+    admin.last_login_at = datetime.now(timezone.utc)
+    db.commit()
+
+
+def list_admins(db: Session) -> list[AdminUser]:
+    stmt = select(AdminUser).order_by(AdminUser.id)
+    return list(db.execute(stmt).scalars().all())
+
+
+def set_role(db: Session, admin: AdminUser, *, role: str) -> AdminUser:
+    admin.role = role
+    db.commit()
+    db.refresh(admin)
+    return admin
+
+
+def set_status(db: Session, admin: AdminUser, *, status: str) -> AdminUser:
+    admin.status = status
+    db.commit()
+    db.refresh(admin)
+    return admin
+
+
+def set_password(db: Session, admin: AdminUser, *, password: str) -> AdminUser:
+    admin.password_hash = hash_password(password)
+    db.commit()
+    db.refresh(admin)
+    return admin

app/admin/repositories/audit_log.py

@@ -0,0 +1,73 @@
+"""admin_audit_log 写入 + 查询。
+
+审计日志只增不改不删——任何写操作经 app.admin.audit.write_audit 落一条。
+"""
+from __future__ import annotations
+
+from sqlalchemy import func, select
+from sqlalchemy.orm import Session
+
+from app.models.admin import AdminAuditLog
+
+
+def add_audit_log(
+    db: Session,
+    *,
+    admin_id: int,
+    admin_username: str,
+    action: str,
+    target_type: str,
+    target_id: str | None = None,
+    detail: dict | None = None,
+    ip: str | None = None,
+    commit: bool = True,
+) -> AdminAuditLog:
+    """插一条审计。commit=False 时只 flush,让调用方把审计和业务写操作放同一事务。"""
+    log = AdminAuditLog(
+        admin_id=admin_id,
+        admin_username=admin_username,
+        action=action,
+        target_type=target_type,
+        target_id=target_id,
+        detail=detail,
+        ip=ip,
+    )
+    db.add(log)
+    if commit:
+        db.commit()
+        db.refresh(log)
+    else:
+        db.flush()
+    return log
+
+
+def list_audit_logs(
+    db: Session,
+    *,
+    action: str | None = None,
+    target_type: str | None = None,
+    admin_id: int | None = None,
+    limit: int = 50,
+    cursor: int | None = None,
+) -> tuple[list[AdminAuditLog], int | None, int]:
+    """offset 分页(id 倒序)+ total。cursor 即 offset((page-1)*pageSize),支持页码跳页。
+    返回 (rows, next_cursor, total)。"""
+    stmt = select(AdminAuditLog)
+    if action:
+        stmt = stmt.where(AdminAuditLog.action == action)
+    if target_type:
+        stmt = stmt.where(AdminAuditLog.target_type == target_type)
+    if admin_id is not None:
+        stmt = stmt.where(AdminAuditLog.admin_id == admin_id)
+
+    total = int(db.execute(select(func.count()).select_from(stmt.subquery())).scalar_one())
+    offset = max(cursor or 0, 0)
+    rows = list(
+        db.execute(
+            stmt.order_by(AdminAuditLog.id.desc()).offset(offset).limit(limit + 1)
+        ).scalars().all()
+    )
+    has_more = len(rows) > limit
+    items = rows[:limit]
+    next_cursor = offset + limit if has_more else None
+    return items, next_cursor, total

app/admin/repositories/mutations.py

@@ -0,0 +1,107 @@
+"""admin 写操作 repo(状态改写)。
+
+涉钱的金币/提现复用 app.repositories.wallet(grant_coins / refresh_withdraw_status /
+reconcile_pending_withdraws),不在这里重写——重写涉钱逻辑就是给自己埋雷。
+
+set_user_status / update_feedback_status 支持 commit=False,让 router 把"业务写 + 审计写"
+放进同一事务一起 commit(原子:改了就有审计、有审计就真改了,见 plan 风险点 1)。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import delete
+from sqlalchemy.orm import Session
+
+from app.core.rewards import CN_TZ
+from app.models.feedback import Feedback
+from app.models.onboarding import OnboardingCompletion
+from app.models.price_report import PriceReport
+from app.models.user import User
+
+
+def set_user_status(db: Session, user: User, *, status: str, commit: bool = True) -> User:
+    user.status = status
+    if commit:
+        db.commit()
+        db.refresh(user)
+    else:
+        db.flush()
+    return user
+
+
+def set_user_debug_trace(
+    db: Session, user: User, *, enabled: bool, commit: bool = True
+) -> User:
+    """开关用户「复制调试链接」权限。同 set_user_status：支持 commit=False 让 router 把
+    业务写 + 审计写放进同一事务。"""
+    user.debug_trace_enabled = enabled
+    if commit:
+        db.commit()
+        db.refresh(user)
+    else:
+        db.flush()
+    return user
+
+
+def update_feedback_status(
+    db: Session, feedback: Feedback, *, status: str, commit: bool = True
+) -> Feedback:
+    feedback.status = status
+    if commit:
+        db.commit()
+        db.refresh(feedback)
+    else:
+        db.flush()
+    return feedback
+
+
+def review_price_report(
+    db: Session,
+    report: PriceReport,
+    *,
+    status: str,
+    reward_coins: int | None = None,
+    reject_reason: str | None = None,
+    commit: bool = True,
+) -> PriceReport:
+    """审核上报:置 approved/rejected + 记审核时间;通过填 reward_coins、拒绝填 reject_reason。
+
+    发金币(wallet.grant_coins)不在这里——由 router 在同一事务里调,涉钱逻辑不重写(见模块头注释)。
+    """
+    report.status = status
+    if reward_coins is not None:
+        report.reward_coins = reward_coins
+    if reject_reason is not None:
+        report.reject_reason = reject_reason
+    report.reviewed_at = datetime.now(CN_TZ).replace(tzinfo=None)  # 北京 wall-clock,同 created_at
+    if commit:
+        db.commit()
+        db.refresh(report)
+    else:
+        db.flush()
+    return report
+
+
+def delete_device_onboarding(db: Session, device_id: str, *, commit: bool = True) -> int:
+    """删某设备(device_id)的全部 onboarding 完成记录 → 该设备上所有账号下次登录重走引导。
+    返回删除行数。支持 commit=False 让 router 把业务写 + 审计写放进同一事务。"""
+    n = db.execute(
+        delete(OnboardingCompletion).where(OnboardingCompletion.device_id == device_id)
+    ).rowcount
+    if commit:
+        db.commit()
+    else:
+        db.flush()
+    return n
+
+
+def delete_all_onboarding(db: Session, *, commit: bool = True) -> int:
+    """清空 onboarding_completion 表 → 所有用户在所有设备下次登录都重走引导。返回删除行数。
+    支持 commit=False(同 delete_device_onboarding)。"""
+    n = db.execute(delete(OnboardingCompletion)).rowcount
+    if commit:
+        db.commit()
+    else:
+        db.flush()
+    return n

app/admin/repositories/queries.py

@@ -0,0 +1,526 @@
+"""admin 跨用户查询(去掉现有 repo 的 user_id 强制过滤)+ 通用游标分页 helper + 用户概览。
+
+现有 app/repositories/ 的 list_* 都强绑单个 user_id(C 端只看自己);admin 要看全量、按条件筛,
+所以在这里另起一套。游标约定与现有一致:id 倒序,cursor=上页最后一条 id,返回 (items, next_cursor)。
+"""
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+from zoneinfo import ZoneInfo
+
+from sqlalchemy import Select, asc, desc, func, or_, select
+from sqlalchemy.orm import Session
+
+from app.models.admin import AdminAuditLog
+from app.models.comparison import ComparisonRecord
+from app.models.feedback import Feedback
+from app.models.onboarding import OnboardingCompletion
+from app.models.price_report import PriceReport
+from app.models.user import User
+from app.models.wallet import CashTransaction, CoinAccount, CoinTransaction, WithdrawOrder
+
+
+def cursor_paginate(
+    db: Session, stmt: Select, id_col, *, limit: int, cursor: int | None
+) -> tuple[list, int | None]:
+    """通用游标分页(id 倒序)。stmt 不要预先带 order_by/limit。
+
+    多取 1 条探测有没有下一页;next_cursor 取本页最后一条的 id(下一页查 id < 它),
+    绝不用第 limit+1 条的 id——那条既不在本页也不在下页,会每页边界丢一条(见 audit_log 同款修复)。
+    """
+    if cursor is not None:
+        stmt = stmt.where(id_col < cursor)
+    stmt = stmt.order_by(id_col.desc()).limit(limit + 1)
+    rows = list(db.execute(stmt).scalars().all())
+    has_more = len(rows) > limit
+    items = rows[:limit]
+    next_cursor = items[-1].id if has_more else None
+    return items, next_cursor
+
+
+def offset_paginate(
+    db: Session, stmt: Select, sort_clause: tuple, *, limit: int, cursor: int | None
+) -> tuple[list, int | None, int]:
+    """offset 分页 + 总数。stmt 只含 where/join,不要预先带 order_by/offset/limit。
+
+    cursor 即 offset(页码分页:offset=(page-1)*pageSize)。返回 (items, next_cursor, total):
+    - total:符合筛选条件的总条数(供 antd pagination 渲染页码/共 N 条),count 在 P0 量级开销可忽略;
+    - next_cursor:下一页 offset(兼容「加载更多」),末页为 None。
+    多取 1 条探测下一页。sort_clause 为 order_by 表达式元组(末位应含 id 保证稳定排序)。"""
+    total = int(
+        db.execute(select(func.count()).select_from(stmt.subquery())).scalar_one()
+    )
+    offset = max(cursor or 0, 0)
+    rows = list(
+        db.execute(stmt.order_by(*sort_clause).offset(offset).limit(limit + 1)).scalars().all()
+    )
+    has_more = len(rows) > limit
+    items = rows[:limit]
+    next_cursor = offset + limit if has_more else None
+    return items, next_cursor, total
+
+
+def list_users(
+    db: Session,
+    *,
+    phone: str | None = None,
+    register_channel: str | None = None,
+    status: str | None = None,
+    nickname: str | None = None,
+    created_from: datetime | None = None,
+    created_to: datetime | None = None,
+    last_login_from: datetime | None = None,
+    last_login_to: datetime | None = None,
+    sort_by: str = "id",
+    sort_order: str = "desc",
+    limit: int = 20,
+    cursor: int | None = None,
+) -> tuple[list[User], int | None, int]:
+    """用户列表(admin 全量)。支持手机号前缀 / 渠道 / 状态 / 昵称模糊 / 注册·最近登录时间范围筛选,
+    按 id·注册时间·最近登录排序。**offset 分页**(cursor=offset):任意列排序下游标语义统一,
+    代价是翻页期间数据变动可能错位一条——admin 低频场景可接受(同 [list_all_withdraw_orders])。
+    日期入参统一转 tz-aware UTC 比较(列为 timestamptz,见 _as_utc)。"""
+    stmt = select(User)
+    if phone:
+        stmt = stmt.where(User.phone.like(f"{phone}%"))  # 前缀匹配
+    if register_channel:
+        stmt = stmt.where(User.register_channel == register_channel)
+    if status:
+        stmt = stmt.where(User.status == status)
+    if nickname and nickname.strip():
+        stmt = stmt.where(User.nickname.ilike(f"%{nickname.strip()}%"))
+    if created_from is not None:
+        stmt = stmt.where(User.created_at >= _as_utc(created_from))
+    if created_to is not None:
+        stmt = stmt.where(User.created_at <= _as_utc(created_to))
+    if last_login_from is not None:
+        stmt = stmt.where(User.last_login_at >= _as_utc(last_login_from))
+    if last_login_to is not None:
+        stmt = stmt.where(User.last_login_at <= _as_utc(last_login_to))
+
+    sort_cols = {
+        "id": User.id,
+        "created_at": User.created_at,
+        "last_login_at": User.last_login_at,
+    }
+    sort_col = sort_cols.get(sort_by, User.id)
+    order_fn = asc if sort_order == "asc" else desc
+    id_order = asc(User.id) if sort_order == "asc" else desc(User.id)
+    return offset_paginate(db, stmt, (order_fn(sort_col), id_order), limit=limit, cursor=cursor)
+
+
+def list_onboarding_devices(db: Session, *, limit: int = 500) -> list[dict]:
+    """按设备(device_id, ANDROID_ID)聚合 onboarding_completion:每台设备走过引导的账号数 +
+    最近完成时间,按最近完成倒序。设备维度新手引导管理用。没走过引导的设备不在表里(本就会
+    引导、无需管理)。当前全量返回(上限 limit;调试期设备少,量大再加分页/搜索)。"""
+    rows = db.execute(
+        select(
+            OnboardingCompletion.device_id,
+            func.count(OnboardingCompletion.id),
+            func.max(OnboardingCompletion.completed_at),
+        )
+        .group_by(OnboardingCompletion.device_id)
+        .order_by(func.max(OnboardingCompletion.completed_at).desc())
+        .limit(limit)
+    ).all()
+    return [
+        {"device_id": did, "account_count": int(cnt), "last_completed_at": last}
+        for did, cnt, last in rows
+    ]
+
+
+def list_all_coin_transactions(
+    db: Session,
+    *,
+    user_id: int | None = None,
+    biz_type: str | None = None,
+    limit: int = 20,
+    cursor: int | None = None,
+) -> tuple[list[CoinTransaction], int | None]:
+    stmt = select(CoinTransaction)
+    if user_id is not None:
+        stmt = stmt.where(CoinTransaction.user_id == user_id)
+    if biz_type:
+        stmt = stmt.where(CoinTransaction.biz_type == biz_type)
+    return cursor_paginate(db, stmt, CoinTransaction.id, limit=limit, cursor=cursor)
+
+
+def list_all_cash_transactions(
+    db: Session,
+    *,
+    user_id: int | None = None,
+    biz_type: str | None = None,
+    limit: int = 20,
+    cursor: int | None = None,
+) -> tuple[list[CashTransaction], int | None]:
+    stmt = select(CashTransaction)
+    if user_id is not None:
+        stmt = stmt.where(CashTransaction.user_id == user_id)
+    if biz_type:
+        stmt = stmt.where(CashTransaction.biz_type == biz_type)
+    return cursor_paginate(db, stmt, CashTransaction.id, limit=limit, cursor=cursor)
+
+
+def list_all_withdraw_orders(
+    db: Session,
+    *,
+    user_id: int | None = None,
+    status: str | None = None,
+    keyword: str | None = None,
+    date_from: datetime | None = None,
+    date_to: datetime | None = None,
+    date_field: str = "created_at",
+    sort_by: str = "created_at",
+    sort_order: str = "desc",
+    quick_filter: str | None = None,
+    limit: int = 20,
+    cursor: int | None = None,
+) -> tuple[list[WithdrawOrder], int | None, int]:
+    stmt = select(WithdrawOrder)
+    needs_user_join = bool(keyword and keyword.strip()) or quick_filter == "high_risk"
+    if needs_user_join:
+        stmt = stmt.outerjoin(User, User.id == WithdrawOrder.user_id)
+
+    if user_id is not None:
+        stmt = stmt.where(WithdrawOrder.user_id == user_id)
+    if status:
+        stmt = stmt.where(WithdrawOrder.status == status)
+
+    kw = (keyword or "").strip()
+    if kw:
+        pattern = f"%{kw}%"
+        conditions = [
+            WithdrawOrder.out_bill_no.ilike(pattern),
+            WithdrawOrder.transfer_bill_no.ilike(pattern),
+            WithdrawOrder.user_name.ilike(pattern),
+            WithdrawOrder.wechat_state.ilike(pattern),
+            WithdrawOrder.fail_reason.ilike(pattern),
+            User.phone.ilike(pattern),
+            User.nickname.ilike(pattern),
+            User.wechat_nickname.ilike(pattern),
+        ]
+        if kw.isdigit():
+            conditions.append(WithdrawOrder.user_id == int(kw))
+        stmt = stmt.where(or_(*conditions))
+
+    date_col = WithdrawOrder.updated_at if date_field == "updated_at" else WithdrawOrder.created_at
+    if date_from is not None:
+        stmt = stmt.where(date_col >= _as_utc(date_from))
+    if date_to is not None:
+        stmt = stmt.where(date_col <= _as_utc(date_to))
+
+    # tz-aware:列为 timestamptz,比较绝对时刻、与 DB 会话时区无关(同 _as_utc / stats.py)
+    now = datetime.now(timezone.utc)
+    today_start = (
+        datetime.now(ZoneInfo("Asia/Shanghai"))
+        .replace(hour=0, minute=0, second=0, microsecond=0)
+        .astimezone(timezone.utc)
+    )
+    if quick_filter == "abnormal":
+        stmt = stmt.where(
+            or_(
+                WithdrawOrder.status.in_(("failed", "rejected")),
+                WithdrawOrder.fail_reason.is_not(None),
+                WithdrawOrder.wechat_state.in_(("FAIL", "CANCELLED", "CLOSED")),
+            )
+        )
+    elif quick_filter == "failed":
+        stmt = stmt.where(WithdrawOrder.status == "failed")
+    elif quick_filter == "overdue_reviewing":
+        stmt = stmt.where(
+            WithdrawOrder.status == "reviewing",
+            WithdrawOrder.created_at <= now - timedelta(minutes=30),
+        )
+    elif quick_filter == "pending_overdue":
+        stmt = stmt.where(
+            WithdrawOrder.status == "pending",
+            WithdrawOrder.updated_at <= now - timedelta(minutes=15),
+        )
+    elif quick_filter == "today":
+        stmt = stmt.where(WithdrawOrder.created_at >= today_start)
+    elif quick_filter == "high_risk":
+        stmt = stmt.where(
+            or_(
+                WithdrawOrder.user_name.is_(None),
+                WithdrawOrder.user_name == "",
+                User.status != "active",
+                User.created_at >= now - timedelta(hours=24),
+                WithdrawOrder.status.in_(("failed", "rejected")),
+                WithdrawOrder.fail_reason.is_not(None),
+            )
+        )
+
+    sort_cols = {
+        "id": WithdrawOrder.id,
+        "created_at": WithdrawOrder.created_at,
+        "updated_at": WithdrawOrder.updated_at,
+        "amount_cents": WithdrawOrder.amount_cents,
+    }
+    sort_col = sort_cols.get(sort_by, WithdrawOrder.created_at)
+    order_fn = asc if sort_order == "asc" else desc
+    id_order = asc(WithdrawOrder.id) if sort_order == "asc" else desc(WithdrawOrder.id)
+    return offset_paginate(db, stmt, (order_fn(sort_col), id_order), limit=limit, cursor=cursor)
+
+
+def _as_utc(value: datetime) -> datetime:
+    """前端传 ISO 时间 → 统一成 tz-aware UTC 再比较。
+
+    所有时间列均为 `DateTime(timezone=True)`(Postgres timestamptz);用 tz-aware 绑定参数
+    比较的是绝对时刻,与 DB 会话时区无关、恒正确。曾用 naive UTC,正确性依赖会话 TimeZone=UTC,
+    生产会话非 UTC 时筛选边界会整体偏移——故统一 tz-aware(与 stats.py / withdraw_summary 一致)。
+    无时区入参按 UTC 解释。"""
+    if value.tzinfo is None:
+        return value.replace(tzinfo=timezone.utc)
+    return value.astimezone(timezone.utc)
+
+
+def list_feedbacks(
+    db: Session,
+    *,
+    status: str | None = None,
+    user_id: int | None = None,
+    content: str | None = None,
+    created_from: datetime | None = None,
+    created_to: datetime | None = None,
+    sort_by: str = "id",
+    sort_order: str = "desc",
+    limit: int = 20,
+    cursor: int | None = None,
+) -> tuple[list[Feedback], int | None]:
+    """反馈工单列表。支持 状态 / 用户ID / 内容模糊 / 提交时间范围 筛选,按 id·提交时间排序。
+    **offset 分页**(cursor=offset):任意列排序下游标语义统一(同 [list_users]),代价是翻页期间
+    数据变动可能错位一条——admin 低频场景可接受。created_at 为 timestamptz,日期入参统一转 tz-aware UTC 比较。"""
+    stmt = select(Feedback)
+    if status:
+        stmt = stmt.where(Feedback.status == status)
+    if user_id is not None:
+        stmt = stmt.where(Feedback.user_id == user_id)
+    if content and content.strip():
+        stmt = stmt.where(Feedback.content.ilike(f"%{content.strip()}%"))
+    if created_from is not None:
+        stmt = stmt.where(Feedback.created_at >= _as_utc(created_from))
+    if created_to is not None:
+        stmt = stmt.where(Feedback.created_at <= _as_utc(created_to))
+
+    sort_cols = {"id": Feedback.id, "created_at": Feedback.created_at}
+    sort_col = sort_cols.get(sort_by, Feedback.id)
+    order_fn = asc if sort_order == "asc" else desc
+    id_order = asc(Feedback.id) if sort_order == "asc" else desc(Feedback.id)
+    stmt = stmt.order_by(order_fn(sort_col), id_order)
+
+    offset = max(cursor or 0, 0)
+    rows = list(db.execute(stmt.offset(offset).limit(limit + 1)).scalars().all())
+    has_more = len(rows) > limit
+    items = rows[:limit]
+    next_cursor = offset + limit if has_more else None
+    return items, next_cursor
+
+
+def get_withdraw_by_out_bill_no(db: Session, out_bill_no: str) -> WithdrawOrder | None:
+    """按商户单号查提现单(admin 重试打款先拿 user_id 用,M3)。"""
+    return db.execute(
+        select(WithdrawOrder).where(WithdrawOrder.out_bill_no == out_bill_no)
+    ).scalar_one_or_none()
+
+
+def withdraw_summary(db: Session) -> dict:
+    """提现审核台顶部统计。金额单位:分。"""
+    rows = db.execute(
+        select(
+            WithdrawOrder.status,
+            func.count(WithdrawOrder.id),
+            func.coalesce(func.sum(WithdrawOrder.amount_cents), 0),
+        ).group_by(WithdrawOrder.status)
+    ).all()
+    by_status = {
+        status: {"count": int(count), "amount_cents": int(amount_cents)}
+        for status, count, amount_cents in rows
+    }
+
+    today_start = (
+        datetime.now(ZoneInfo("Asia/Shanghai"))
+        .replace(hour=0, minute=0, second=0, microsecond=0)
+        .astimezone(timezone.utc)
+    )
+
+    def _today_count(status: str) -> int:
+        return db.execute(
+            select(func.count(WithdrawOrder.id)).where(
+                WithdrawOrder.status == status,
+                WithdrawOrder.updated_at >= today_start,
+            )
+        ).scalar_one()
+
+    today_success_amount = db.execute(
+        select(func.coalesce(func.sum(WithdrawOrder.amount_cents), 0)).where(
+            WithdrawOrder.status == "success",
+            WithdrawOrder.updated_at >= today_start,
+        )
+    ).scalar_one()
+
+    return {
+        "reviewing_count": by_status.get("reviewing", {}).get("count", 0),
+        "reviewing_amount_cents": by_status.get("reviewing", {}).get("amount_cents", 0),
+        "pending_count": by_status.get("pending", {}).get("count", 0),
+        "failed_count": by_status.get("failed", {}).get("count", 0),
+        "today_success_count": _today_count("success"),
+        "today_success_amount_cents": int(today_success_amount),
+        "today_rejected_count": _today_count("rejected"),
+    }
+
+
+def list_withdraw_audit_logs(
+    db: Session, out_bill_no: str, *, limit: int = 20
+) -> list[AdminAuditLog]:
+    return list(
+        db.execute(
+            select(AdminAuditLog)
+            .where(AdminAuditLog.target_type == "withdraw", AdminAuditLog.target_id == out_bill_no)
+            .order_by(AdminAuditLog.id.desc())
+            .limit(limit)
+        ).scalars().all()
+    )
+
+
+def withdraw_risk_flags(
+    order: WithdrawOrder,
+    user: User | None,
+    recent_withdraws: list[WithdrawOrder],
+    cash_balance_cents: int,
+) -> tuple[list[str], int]:
+    flags: list[str] = []
+    if not order.user_name:
+        flags.append("缺少提现实名")
+    if user and user.status != "active":
+        flags.append(f"账号状态:{user.status}")
+    if user and user.created_at:
+        created_at = user.created_at.replace(tzinfo=timezone.utc) if user.created_at.tzinfo is None else user.created_at
+        if datetime.now(timezone.utc) - created_at < timedelta(hours=24):
+            flags.append("新注册用户")
+    failed_or_rejected = sum(1 for item in recent_withdraws if item.status in {"failed", "rejected"})
+    if failed_or_rejected:
+        flags.append(f"历史异常提现{failed_or_rejected}笔")
+    recent_reviewing = sum(1 for item in recent_withdraws if item.status == "reviewing")
+    if recent_reviewing >= 3:
+        flags.append(f"待审核提现偏多:{recent_reviewing}笔")
+    if cash_balance_cents < 0:
+        flags.append("现金余额为负")
+    score = min(100, len(flags) * 20 + failed_or_rejected * 10)
+    return flags, score
+
+
+def withdraw_ledger_check(db: Session) -> dict:
+    cash_balance_total = int(
+        db.execute(select(func.coalesce(func.sum(CoinAccount.cash_balance_cents), 0))).scalar_one()
+    )
+    cash_txn_total = int(
+        db.execute(select(func.coalesce(func.sum(CashTransaction.amount_cents), 0))).scalar_one()
+    )
+
+    orders = list(db.execute(select(WithdrawOrder)).scalars().all())
+    cash_txns = list(
+        db.execute(
+            select(CashTransaction).where(
+                CashTransaction.biz_type.in_(("withdraw", "withdraw_refund"))
+            )
+        ).scalars().all()
+    )
+    withdraw_refs = {txn.ref_id for txn in cash_txns if txn.biz_type == "withdraw"}
+    refund_counts: dict[str, int] = {}
+    for txn in cash_txns:
+        if txn.biz_type == "withdraw_refund" and txn.ref_id:
+            refund_counts[txn.ref_id] = refund_counts.get(txn.ref_id, 0) + 1
+
+    missing_withdraw = 0
+    missing_refund = 0
+    refund_on_non_terminal = 0
+    for order in orders:
+        if order.out_bill_no not in withdraw_refs:
+            missing_withdraw += 1
+        has_refund = refund_counts.get(order.out_bill_no, 0) > 0
+        if order.status in {"failed", "rejected"} and not has_refund:
+            missing_refund += 1
+        if has_refund and order.status not in {"failed", "rejected"}:
+            refund_on_non_terminal += 1
+
+    duplicate_refund = sum(1 for count in refund_counts.values() if count > 1)
+    diff = cash_balance_total - cash_txn_total
+    ok = (
+        diff == 0
+        and missing_withdraw == 0
+        and missing_refund == 0
+        and duplicate_refund == 0
+        and refund_on_non_terminal == 0
+    )
+    return {
+        "ok": ok,
+        "cash_balance_total_cents": cash_balance_total,
+        "cash_transaction_total_cents": cash_txn_total,
+        "balance_diff_cents": diff,
+        "missing_withdraw_txn_count": missing_withdraw,
+        "missing_refund_txn_count": missing_refund,
+        "duplicate_refund_txn_count": duplicate_refund,
+        "refund_txn_on_non_terminal_count": refund_on_non_terminal,
+    }
+
+
+def get_user_overview(db: Session, user_id: int) -> dict | None:
+    """用户 360 概览:基础资料 + 钱包余额 + 各项 count。历史明细走各自分页接口(带 user_id 过滤)。"""
+    user = db.get(User, user_id)
+    if user is None:
+        return None
+    acc = db.get(CoinAccount, user_id)  # 可能为 None(从未发生过金币动作)
+
+    def _count(model, *conds) -> int:
+        return db.execute(select(func.count(model.id)).where(*conds)).scalar_one()
+
+    return {
+        "user": user,
+        "coin_balance": acc.coin_balance if acc else 0,
+        "cash_balance_cents": acc.cash_balance_cents if acc else 0,
+        "total_coin_earned": acc.total_coin_earned if acc else 0,
+        "comparison_total": _count(ComparisonRecord, ComparisonRecord.user_id == user_id),
+        "comparison_success": _count(
+            ComparisonRecord,
+            ComparisonRecord.user_id == user_id,
+            ComparisonRecord.status == "success",
+        ),
+        "withdraw_total": _count(WithdrawOrder, WithdrawOrder.user_id == user_id),
+        "withdraw_success_cents": db.execute(
+            select(func.coalesce(func.sum(WithdrawOrder.amount_cents), 0)).where(
+                WithdrawOrder.user_id == user_id, WithdrawOrder.status == "success"
+            )
+        ).scalar_one(),
+        "feedback_total": _count(Feedback, Feedback.user_id == user_id),
+    }
+
+
+def list_price_reports(
+    db: Session,
+    *,
+    status: str | None = None,
+    user_id: int | None = None,
+    limit: int = 20,
+    cursor: int | None = None,
+) -> tuple[list[PriceReport], int | None, int]:
+    """上报更低价列表(admin 全量,可按状态/用户筛)。offset 分页 + total,id 倒序。"""
+    stmt = select(PriceReport)
+    if status:
+        stmt = stmt.where(PriceReport.status == status)
+    if user_id is not None:
+        stmt = stmt.where(PriceReport.user_id == user_id)
+    return offset_paginate(db, stmt, (PriceReport.id.desc(),), limit=limit, cursor=cursor)
+
+
+def price_report_summary(db: Session) -> dict:
+    """上报审核台各状态计数(待审核/已通过/已拒绝/合计)。"""
+    rows = db.execute(
+        select(PriceReport.status, func.count(PriceReport.id)).group_by(PriceReport.status)
+    ).all()
+    by_status = {status: int(count) for status, count in rows}
+    return {
+        "pending": by_status.get("pending", 0),
+        "approved": by_status.get("approved", 0),
+        "rejected": by_status.get("rejected", 0),
+        "total": sum(by_status.values()),
+    }

app/admin/repositories/stats.py

@@ -0,0 +1,125 @@
+"""admin 大盘聚合查询(全局 count/sum/DAU/成功率)。全部只读、不改任何数据。
+
+⚠️ 性能:这些是全表 count/sum,P0 数据量小够用;用户量上来后热点字段(user.created_at /
+user.last_login_at / comparison_record.status / withdraw_order.status)要加索引,或改增量统计表。
+"""
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+
+from sqlalchemy import func, select
+from sqlalchemy.orm import Session
+
+from app.models.ad_feed_reward import AdFeedRewardRecord
+from app.models.ad_reward import AdRewardRecord
+from app.models.comparison import ComparisonRecord
+from app.models.feedback import Feedback
+from app.models.signin import SigninBoostRecord, SigninRecord
+from app.models.user import User
+from app.models.wallet import CoinTransaction, WithdrawOrder
+
+_BEIJING = timezone(timedelta(hours=8))
+
+
+def _beijing_today_start_utc() -> datetime:
+    """北京时间今天 0 点对应的 UTC 时刻(DAU / 今日新增按北京时区切天)。"""
+    now_bj = datetime.now(_BEIJING)
+    start_bj = now_bj.replace(hour=0, minute=0, second=0, microsecond=0)
+    return start_bj.astimezone(timezone.utc)
+
+
+def dashboard_overview(db: Session) -> dict:
+    today_start = _beijing_today_start_utc()
+
+    def _count(model, *conds) -> int:
+        stmt = select(func.count(model.id))
+        if conds:
+            stmt = stmt.where(*conds)
+        return db.execute(stmt).scalar_one()
+
+    def _sum(col, *conds) -> int:
+        stmt = select(func.coalesce(func.sum(col), 0))
+        if conds:
+            stmt = stmt.where(*conds)
+        return db.execute(stmt).scalar_one()
+
+    # ===== 用户 =====
+    by_status = dict(
+        db.execute(select(User.status, func.count(User.id)).group_by(User.status)).all()
+    )
+
+    # ===== 提现状态分布 =====
+    wd_by_status = dict(
+        db.execute(
+            select(WithdrawOrder.status, func.count(WithdrawOrder.id)).group_by(
+                WithdrawOrder.status
+            )
+        ).all()
+    )
+
+    # ===== 比价 =====
+    comparison_total = _count(ComparisonRecord)
+    comparison_success = _count(ComparisonRecord, ComparisonRecord.status == "success")
+    success_rate = round(comparison_success / comparison_total, 4) if comparison_total else 0.0
+
+    return {
+        "users": {
+            "total": _count(User),
+            "active": by_status.get("active", 0),
+            "disabled": by_status.get("disabled", 0),
+            "deleted": by_status.get("deleted", 0),
+            "new_today": _count(User, User.created_at >= today_start),
+            "dau": _count(User, User.last_login_at >= today_start),
+        },
+        "coins": {
+            # 累计发放金币(coin_transaction 里所有 amount>0 之和;负数是兑换/扣减不计)
+            "granted_total": _sum(CoinTransaction.amount, CoinTransaction.amount > 0),
+            "reward_video_coin_total": _sum(
+                CoinTransaction.amount,
+                CoinTransaction.amount > 0,
+                CoinTransaction.biz_type.in_(("reward_video", "ad_reward")),
+            ),
+            "reward_video_watch_count": _count(
+                AdRewardRecord,
+                AdRewardRecord.reward_scene == "reward_video",
+                AdRewardRecord.status == "granted",
+            ),
+            "feed_ad_coin_total": _sum(
+                CoinTransaction.amount,
+                CoinTransaction.amount > 0,
+                CoinTransaction.biz_type == "feed_ad_reward",
+            ),
+            "feed_ad_watch_count": _count(
+                AdFeedRewardRecord,
+                AdFeedRewardRecord.status == "granted",
+            ),
+            "signin_coin_total": _sum(
+                CoinTransaction.amount,
+                CoinTransaction.amount > 0,
+                CoinTransaction.biz_type == "signin",
+            ),
+            "signin_count": _count(SigninRecord),
+            "signin_boost_coin_total": _sum(
+                CoinTransaction.amount,
+                CoinTransaction.amount > 0,
+                CoinTransaction.biz_type == "signin_boost",
+            ),
+            "signin_boost_watch_count": _count(SigninBoostRecord),
+        },
+        "cash": {
+            "withdraw_success_cents": _sum(
+                WithdrawOrder.amount_cents, WithdrawOrder.status == "success"
+            ),
+            "withdraw_pending_count": wd_by_status.get("pending", 0),
+            "withdraw_success_count": wd_by_status.get("success", 0),
+            "withdraw_failed_count": wd_by_status.get("failed", 0),
+        },
+        "comparison": {
+            "total": comparison_total,
+            "success": comparison_success,
+            "success_rate": success_rate,
+        },
+        "feedback": {"new": _count(Feedback, Feedback.status == "new")},
+        # CPS 收入数据源未接(referral-link 只换链接,转化/佣金未回收)→ 前端显示"待接入"。
+        "cps": {"available": False, "note": "CPS 转化数据未接入(P2)"},
+    }

app/admin/routers/__init__.py

@@ -0,0 +1 @@
+"""admin 路由(前缀统一 /admin/api)。"""

app/admin/routers/ad_audit.py

@@ -0,0 +1,48 @@
+"""admin 看广告金币审计:只读对账,核对发奖金币是否按公式计算。
+
+任意已登录 admin 可看(只读,不涉及资金操作)。复算逻辑在 app/admin/repositories/ad_audit.py。
+"""
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Query
+
+from app.admin.deps import AdminDb, get_current_admin
+from app.admin.repositories import ad_audit
+from app.admin.schemas.ad_audit import AdCoinAuditOut, AdCoinAuditRow, AdCoinFormulaOut
+from app.core.rewards import cn_today
+
+router = APIRouter(
+    prefix="/admin/api/ad-coin-audit",
+    tags=["admin-ad-coin-audit"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get("", response_model=AdCoinAuditOut, summary="看广告金币公式审计(复算对比)")
+def get_ad_coin_audit(
+    db: AdminDb,
+    date: Annotated[str | None, Query(description="北京时间 YYYY-MM-DD,默认今天")] = None,
+    user_id: Annotated[int | None, Query(description="只看某用户;不传=全部用户")] = None,
+    scene: Annotated[
+        str | None, Query(description="reward_video / feed;不传=两类都要")
+    ] = None,
+    limit: Annotated[int, Query(ge=1, le=500)] = 100,
+    only_mismatch: Annotated[
+        bool, Query(description="只看不一致(✗)行;统计数仍按全量,不受影响")
+    ] = False,
+) -> AdCoinAuditOut:
+    audit_date = date or cn_today().isoformat()
+    result = ad_audit.ad_coin_audit(
+        db, date=audit_date, user_id=user_id, scene=scene, limit=limit,
+        only_mismatch=only_mismatch,
+    )
+    return AdCoinAuditOut(
+        date=audit_date,
+        formula=AdCoinFormulaOut(**ad_audit.formula_snapshot()),
+        total=result["total"],
+        mismatch_count=result["mismatch_count"],
+        truncated=result["truncated"],
+        items=[AdCoinAuditRow(**r) for r in result["items"]],
+    )

app/admin/routers/admins.py

@@ -0,0 +1,88 @@
+"""admin 账号管理(仅 super_admin):列表 / 创建 / 改角色启停重置密码。均写审计。"""
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, CurrentAdmin, get_client_ip, require_role
+from app.admin.repositories import admin_user as admin_repo
+from app.admin.schemas.admin import AdminCreateRequest, AdminUpdateRequest
+from app.admin.schemas.auth import AdminOut
+from app.core.security import hash_password
+
+router = APIRouter(
+    prefix="/admin/api/admins",
+    tags=["admin-accounts"],
+    dependencies=[Depends(require_role())],  # require_role() 无参 = 仅 super_admin 通过
+)
+
+
+def _active_super_count(db: AdminDb) -> int:
+    return sum(
+        1 for a in admin_repo.list_admins(db) if a.role == "super_admin" and a.status == "active"
+    )
+
+
+@router.get("", response_model=list[AdminOut], summary="管理员列表")
+def list_admins(db: AdminDb) -> list[AdminOut]:
+    return [AdminOut.model_validate(a) for a in admin_repo.list_admins(db)]
+
+
+@router.post("", response_model=AdminOut, summary="创建管理员")
+def create_admin(
+    body: AdminCreateRequest, request: Request, admin: CurrentAdmin, db: AdminDb
+) -> AdminOut:
+    if admin_repo.get_by_username(db, body.username) is not None:
+        raise HTTPException(status_code=409, detail="用户名已存在")
+    new = admin_repo.create_admin(
+        db, username=body.username, password=body.password, role=body.role
+    )
+    write_audit(
+        db, admin, action="admin.create", target_type="admin", target_id=new.id,
+        detail={"username": new.username, "role": new.role}, ip=get_client_ip(request), commit=True,
+    )
+    return AdminOut.model_validate(new)
+
+
+@router.patch("/{admin_id}", response_model=AdminOut, summary="改角色/启停/重置密码")
+def update_admin(
+    admin_id: int, body: AdminUpdateRequest, request: Request, admin: CurrentAdmin, db: AdminDb
+) -> AdminOut:
+    target = admin_repo.get_by_id(db, admin_id)
+    if target is None:
+        raise HTTPException(status_code=404, detail="管理员不存在")
+    if admin_id == admin.id and body.status == "disabled":
+        raise HTTPException(status_code=400, detail="不能禁用自己")
+
+    # 防自锁:降级 / 禁用某个 super_admin 前,确认操作后仍至少剩 1 个 active super_admin,
+    # 否则会进入「零可用超管」死局——本路由仅 super 可进,只能改库恢复。
+    demotes_super = (
+        target.role == "super_admin"
+        and target.status == "active"
+        and (
+            (body.role is not None and body.role != "super_admin")
+            or body.status == "disabled"
+        )
+    )
+    if demotes_super and _active_super_count(db) <= 1:
+        raise HTTPException(status_code=400, detail="不能降级/禁用最后一个超级管理员")
+
+    changes: dict = {}
+    if body.role is not None and body.role != target.role:
+        changes["role"] = {"before": target.role, "after": body.role}
+        target.role = body.role
+    if body.status is not None and body.status != target.status:
+        changes["status"] = {"before": target.status, "after": body.status}
+        target.status = body.status
+    if body.password is not None:
+        changes["password"] = "reset"
+        target.password_hash = hash_password(body.password)
+    if not changes:
+        raise HTTPException(status_code=400, detail="无任何变更字段")
+    db.commit()
+    db.refresh(target)
+    write_audit(
+        db, admin, action="admin.update", target_type="admin", target_id=admin_id,
+        detail=changes, ip=get_client_ip(request), commit=True,
+    )
+    return AdminOut.model_validate(target)

app/admin/routers/audit.py

@@ -0,0 +1,36 @@
+"""admin 操作审计日志查询(所有 admin 可看:谁在何时对什么做了什么)。"""
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Query
+
+from app.admin.deps import AdminDb, get_current_admin
+from app.admin.repositories import audit_log as audit_repo
+from app.admin.schemas.admin import AdminAuditLogOut
+from app.admin.schemas.common import CursorPage
+
+router = APIRouter(
+    prefix="/admin/api/audit-logs",
+    tags=["admin-audit"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get("", response_model=CursorPage[AdminAuditLogOut], summary="审计日志(谁改了什么)")
+def list_audit_logs(
+    db: AdminDb,
+    action: Annotated[str | None, Query()] = None,
+    target_type: Annotated[str | None, Query()] = None,
+    admin_id: Annotated[int | None, Query()] = None,
+    limit: Annotated[int, Query(ge=1, le=100)] = 50,
+    cursor: Annotated[int | None, Query()] = None,
+) -> CursorPage[AdminAuditLogOut]:
+    items, next_cursor, total = audit_repo.list_audit_logs(
+        db, action=action, target_type=target_type, admin_id=admin_id, limit=limit, cursor=cursor,
+    )
+    return CursorPage(
+        items=[AdminAuditLogOut.model_validate(x) for x in items],
+        next_cursor=next_cursor,
+        total=total,
+    )

app/admin/routers/auth.py

@@ -0,0 +1,48 @@
+"""Admin 认证:账号密码登录 → admin JWT(独立 secret)。"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Depends, HTTPException
+
+from app.admin.deps import AdminDb, CurrentAdmin
+from app.admin.repositories import admin_user as admin_repo
+from app.admin.schemas.auth import AdminLoginRequest, AdminLoginResponse, AdminOut
+from app.admin.security import create_admin_token
+from app.core.ratelimit import rate_limit
+from app.core.security import verify_password
+
+logger = logging.getLogger("shagua.admin.auth")
+
+router = APIRouter(prefix="/admin/api/auth", tags=["admin-auth"])
+
+
+@router.post(
+    "/login",
+    response_model=AdminLoginResponse,
+    summary="管理员登录",
+    dependencies=[Depends(rate_limit(10, 60, "admin-login"))],  # 同 IP 每分钟≤10 次,防爆破
+)
+def login(req: AdminLoginRequest, db: AdminDb) -> AdminLoginResponse:
+    admin = admin_repo.get_by_username(db, req.username)
+    # 用户名不存在 / 密码错统一 401 同文案(防账号枚举)。
+    # disabled 账号单独 403"账号已禁用":admin 是内部少数已知账号、无枚举价值,
+    # 明确提示比防枚举更有运维价值(与 App 端 auth.py 对 disabled 用户的 403 一致)。
+    if admin is None or not verify_password(req.password, admin.password_hash):
+        raise HTTPException(status_code=401, detail="用户名或密码错误")
+    if admin.status != "active":
+        raise HTTPException(status_code=403, detail="账号已禁用")
+
+    token, expires_in = create_admin_token(admin_id=admin.id, role=admin.role)
+    admin_repo.update_last_login(db, admin)
+    logger.info("admin login ok id=%d username=%s role=%s", admin.id, admin.username, admin.role)
+    return AdminLoginResponse(
+        access_token=token,
+        expires_in=expires_in,
+        admin=AdminOut.model_validate(admin),
+    )
+
+
+@router.get("/me", response_model=AdminOut, summary="当前管理员")
+def me(admin: CurrentAdmin) -> AdminOut:
+    return AdminOut.model_validate(admin)

app/admin/routers/config.py

@@ -0,0 +1,82 @@
+"""admin 运营配置:列出所有可配项 + 改某项(带审计 + 改值校验)。
+
+配置项定义见 app.core.config_schema.CONFIG_DEFS;业务读配置 fallback 默认(见 app_config repo)。
+权限:operator / finance 都可改(运营调奖励、财务调额度),super 恒可。
+"""
+from __future__ import annotations
+
+from typing import Annotated, Any
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
+from app.admin.schemas.config import ConfigItemOut, ConfigUpdateRequest
+from app.core.config_schema import CONFIG_DEFS
+from app.core.rewards import SIGNIN_CYCLE_LEN
+from app.models.admin import AdminUser
+from app.repositories import app_config
+
+router = APIRouter(
+    prefix="/admin/api/config",
+    tags=["admin-config"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+def _validate(key: str, value: Any) -> None:
+    """按配置项 type 校验新值,不合法抛 ValueError(router 转 400)。"""
+    t = CONFIG_DEFS[key]["type"]
+    if t == "int":
+        if not isinstance(value, int) or isinstance(value, bool) or value < 0:
+            raise ValueError("需为非负整数")
+    elif t == "int_list":
+        if not isinstance(value, list) or not value:
+            raise ValueError("需为非空整数列表")
+        if not all(isinstance(x, int) and not isinstance(x, bool) and x >= 0 for x in value):
+            raise ValueError("列表元素需为非负整数")
+        if key == "signin_rewards" and len(value) != SIGNIN_CYCLE_LEN:
+            raise ValueError(f"签到档位必须正好 {SIGNIN_CYCLE_LEN} 个(对应 {SIGNIN_CYCLE_LEN} 天循环)")
+    elif t == "dict_str_int":
+        if not isinstance(value, dict) or not all(
+            isinstance(k, str) and isinstance(v, int) and not isinstance(v, bool)
+            for k, v in value.items()
+        ):
+            raise ValueError("需为 {字符串: 整数} 映射")
+
+
+def _item(db, key: str) -> ConfigItemOut:
+    for item in app_config.list_all(db):
+        if item["key"] == key:
+            return ConfigItemOut(**item)
+    raise HTTPException(status_code=404, detail="未知配置项")
+
+
+@router.get("", response_model=list[ConfigItemOut], summary="所有可配项 + 当前值")
+def list_config(db: AdminDb) -> list[ConfigItemOut]:
+    return [ConfigItemOut(**item) for item in app_config.list_all(db)]
+
+
+@router.patch("/{key}", response_model=ConfigItemOut, summary="改某项配置(带审计)")
+def update_config(
+    key: str,
+    body: ConfigUpdateRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator", "finance"))],
+    db: AdminDb,
+) -> ConfigItemOut:
+    if key not in CONFIG_DEFS:
+        raise HTTPException(status_code=404, detail="未知配置项")
+    try:
+        _validate(key, body.value)
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e)) from e
+
+    before = app_config.get_value(db, key)
+    app_config.set_value(db, key, body.value, admin_id=admin.id, commit=False)
+    write_audit(
+        db, admin, action="config.set", target_type="config", target_id=key,
+        detail={"before": before, "after": body.value}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return _item(db, key)

app/admin/routers/dashboard.py

@@ -0,0 +1,19 @@
+"""admin 数据大盘(只读聚合)。"""
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends
+
+from app.admin.deps import AdminDb, get_current_admin
+from app.admin.repositories import stats
+from app.admin.schemas.dashboard import DashboardOverview
+
+router = APIRouter(
+    prefix="/admin/api/stats",
+    tags=["admin-stats"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get("/overview", response_model=DashboardOverview, summary="大盘核心指标")
+def overview(db: AdminDb) -> DashboardOverview:
+    return DashboardOverview.model_validate(stats.dashboard_overview(db))

app/admin/routers/feedback.py

@@ -0,0 +1,71 @@
+"""admin 反馈工单:列表(读,支持 状态/用户ID/内容/时间 筛选 + 排序)+ 标记已处理(写,带审计)。"""
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
+from app.admin.repositories import mutations, queries
+from app.admin.schemas.common import CursorPage, OkResponse
+from app.admin.schemas.feedback import FeedbackOut
+from app.models.admin import AdminUser
+from app.models.feedback import Feedback
+
+router = APIRouter(
+    prefix="/admin/api/feedbacks",
+    tags=["admin-feedback"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get("", response_model=CursorPage[FeedbackOut], summary="反馈工单列表")
+def list_feedbacks(
+    db: AdminDb,
+    status: Annotated[str | None, Query()] = None,
+    user_id: Annotated[int | None, Query()] = None,
+    content: Annotated[str | None, Query(max_length=100)] = None,
+    created_from: Annotated[datetime | None, Query()] = None,
+    created_to: Annotated[datetime | None, Query()] = None,
+    sort_by: Annotated[str, Query(pattern="^(id|created_at)$")] = "id",
+    sort_order: Annotated[str, Query(pattern="^(asc|desc)$")] = "desc",
+    limit: Annotated[int, Query(ge=1, le=100)] = 20,
+    cursor: Annotated[int | None, Query()] = None,
+) -> CursorPage[FeedbackOut]:
+    items, next_cursor = queries.list_feedbacks(
+        db,
+        status=status,
+        user_id=user_id,
+        content=content,
+        created_from=created_from,
+        created_to=created_to,
+        sort_by=sort_by,
+        sort_order=sort_order,
+        limit=limit,
+        cursor=cursor,
+    )
+    return CursorPage(
+        items=[FeedbackOut.model_validate(f) for f in items], next_cursor=next_cursor,
+    )
+
+
+@router.post("/{feedback_id}/handle", response_model=OkResponse, summary="标记反馈已处理")
+def handle_feedback(
+    feedback_id: int,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OkResponse:
+    fb = db.get(Feedback, feedback_id)
+    if fb is None:
+        raise HTTPException(status_code=404, detail="反馈不存在")
+    before = fb.status
+    mutations.update_feedback_status(db, fb, status="handled", commit=False)
+    write_audit(
+        db, admin, action="feedback.handle", target_type="feedback", target_id=feedback_id,
+        detail={"before": before, "after": "handled"}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()

app/admin/routers/onboarding.py

@@ -0,0 +1,86 @@
+"""admin 设备维度新手引导管理:列设备 / 重置单设备 / 全部重置。
+
+背景:原 force_onboarding(运营「按用户」强制引导)客户端不认(被 onboarding_completed 压过),
+已废弃。改为直接操作 onboarding_completion(设备+账号 维度):删记录 → 该(设备,账号)的
+onboarding_completed 变 false → 客户端任何版本下次登录都重走引导。可靠、不依赖客户端实现。
+"""
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
+from app.admin.repositories import mutations, queries
+from app.admin.schemas.common import CursorPage, OkResponse
+from app.admin.schemas.onboarding import DeviceOnboardingItem, ResetAllRequest
+from app.models.admin import AdminUser
+
+router = APIRouter(
+    prefix="/admin/api/onboarding",
+    tags=["admin-onboarding"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get(
+    "/devices",
+    response_model=CursorPage[DeviceOnboardingItem],
+    summary="设备列表(按设备聚合走过引导的账号)",
+)
+def list_devices(db: AdminDb) -> CursorPage[DeviceOnboardingItem]:
+    """列出走过新手引导的设备(ANDROID_ID),按最近完成时间倒序。没走过引导的设备不在表里、
+    本就会引导,无需管理,故不列。当前全量返回(上限 500;设备量大再加分页/搜索),
+    next_cursor 恒 None。"""
+    rows = queries.list_onboarding_devices(db)
+    return CursorPage(
+        items=[DeviceOnboardingItem(**r) for r in rows],
+        next_cursor=None,
+    )
+
+
+@router.post(
+    "/devices/{device_id}/reset",
+    response_model=OkResponse,
+    summary="重置单个设备(该设备所有账号下次重走引导)",
+)
+def reset_device(
+    device_id: str,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OkResponse:
+    """删该设备的全部 onboarding 完成记录 → 该设备上所有账号下次登录重走引导。"""
+    # 业务写 + 审计写同一事务(commit=False),最后一起 commit(同 users 各写接口)
+    deleted = mutations.delete_device_onboarding(db, device_id, commit=False)
+    write_audit(
+        db, admin, action="device_onboarding.reset", target_type="device", target_id=device_id,
+        detail={"deleted_rows": deleted}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()
+
+
+@router.post(
+    "/reset-all",
+    response_model=OkResponse,
+    summary="全部重设(清空所有设备引导记录)",
+)
+def reset_all(
+    body: ResetAllRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OkResponse:
+    """清空 onboarding_completion 表 → 所有用户在所有设备下次登录都重走引导。
+    需 confirm=true 防误触(前端另有二次确认弹窗)。"""
+    if not body.confirm:
+        raise HTTPException(status_code=400, detail="需 confirm=true 确认")
+    deleted = mutations.delete_all_onboarding(db, commit=False)
+    write_audit(
+        db, admin, action="device_onboarding.reset_all", target_type="onboarding", target_id=None,
+        detail={"deleted_rows": deleted}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()

app/admin/routers/ops_marquee_seed.py

@@ -0,0 +1,196 @@
+"""admin 首页轮播种子管理:列出 / 新增 / 改 / 删 / 批量生成 / 预览(带审计)。
+
+种子用于首页轮播「真实+种子混播」的兜底(见 app/repositories/ops_marquee.py)。
+权限:operator 可改,super 恒可;预览为只读(任意已登录 admin)。
+"""
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
+from app.admin.schemas.ops_marquee_seed import (
+    OpsMarqueeSeedBatchDelete,
+    OpsMarqueeSeedBatchEnable,
+    OpsMarqueeSeedBulkCreate,
+    OpsMarqueeSeedCreate,
+    OpsMarqueeSeedOut,
+    OpsMarqueeSeedUpdate,
+    OpsSavingsFeedPreviewOut,
+)
+from app.models.admin import AdminUser
+from app.models.ops_marquee_seed import OpsMarqueeSeed
+from app.repositories import ops_marquee
+
+router = APIRouter(
+    prefix="/admin/api/marquee-seeds",
+    tags=["admin-marquee-seeds"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+def _out(seed: OpsMarqueeSeed) -> OpsMarqueeSeedOut:
+    return OpsMarqueeSeedOut(
+        id=seed.id,
+        masked_user=seed.masked_user,
+        min_cents=seed.min_cents,
+        max_cents=seed.max_cents,
+        enabled=seed.enabled,
+        sort_order=seed.sort_order,
+        created_at=seed.created_at.isoformat() if seed.created_at else None,
+    )
+
+
+@router.get("", response_model=list[OpsMarqueeSeedOut], summary="轮播种子列表")
+def list_seeds(db: AdminDb) -> list[OpsMarqueeSeedOut]:
+    return [_out(s) for s in ops_marquee.list_seeds(db)]
+
+
+@router.get("/preview", response_model=OpsSavingsFeedPreviewOut, summary="预览实际混播 feed")
+def preview_feed(
+    db: AdminDb,
+    limit: Annotated[int, Query(ge=1, le=30)] = 8,
+) -> OpsSavingsFeedPreviewOut:
+    """返回客户端实际会看到的 feed(真实记录会插队、种子随机抽取/金额随机/名字合成),供运营对效果。"""
+    return OpsSavingsFeedPreviewOut(items=ops_marquee.get_feed(db, limit=limit))
+
+
+@router.post("", response_model=OpsMarqueeSeedOut, summary="新增轮播种子(带审计)")
+def create_seed(
+    body: OpsMarqueeSeedCreate,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OpsMarqueeSeedOut:
+    try:
+        seed = ops_marquee.create_seed(
+            db,
+            masked_user=body.masked_user,
+            min_cents=body.min_cents,
+            max_cents=body.max_cents,
+            enabled=body.enabled,
+            sort_order=body.sort_order,
+            commit=False,
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e)) from e
+    write_audit(
+        db, admin, action="ops_marquee_seed.create", target_type="ops_marquee_seed",
+        target_id=None, detail=body.model_dump(), ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    db.refresh(seed)
+    return _out(seed)
+
+
+@router.post("/bulk", response_model=list[OpsMarqueeSeedOut], summary="批量生成种子(带审计)")
+def bulk_generate(
+    body: OpsMarqueeSeedBulkCreate,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> list[OpsMarqueeSeedOut]:
+    try:
+        seeds = ops_marquee.bulk_generate(
+            db,
+            count=body.count,
+            min_cents=body.min_cents,
+            max_cents=body.max_cents,
+            enabled=body.enabled,
+            commit=False,
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e)) from e
+    write_audit(
+        db, admin, action="ops_marquee_seed.bulk_generate", target_type="ops_marquee_seed",
+        target_id=None, detail=body.model_dump(), ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    for s in seeds:
+        db.refresh(s)
+    return [_out(s) for s in seeds]
+
+
+@router.post("/batch-delete", summary="批量删除种子(带审计)")
+def batch_delete_seeds(
+    body: OpsMarqueeSeedBatchDelete,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> dict:
+    n = ops_marquee.batch_delete(db, body.ids, commit=False)
+    write_audit(
+        db, admin, action="ops_marquee_seed.batch_delete", target_type="ops_marquee_seed",
+        target_id=None, detail={"ids": body.ids, "deleted": n},
+        ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return {"deleted": n}
+
+
+@router.post("/batch-enable", summary="批量启用 / 停用种子(带审计)")
+def batch_enable_seeds(
+    body: OpsMarqueeSeedBatchEnable,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> dict:
+    n = ops_marquee.batch_set_enabled(db, body.ids, body.enabled, commit=False)
+    write_audit(
+        db, admin, action="ops_marquee_seed.batch_enable", target_type="ops_marquee_seed",
+        target_id=None, detail={"ids": body.ids, "enabled": body.enabled, "updated": n},
+        ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return {"updated": n}
+
+
+@router.patch("/{seed_id}", response_model=OpsMarqueeSeedOut, summary="改轮播种子(带审计)")
+def update_seed(
+    seed_id: int,
+    body: OpsMarqueeSeedUpdate,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OpsMarqueeSeedOut:
+    try:
+        seed = ops_marquee.update_seed(
+            db,
+            seed_id,
+            masked_user=body.masked_user,
+            min_cents=body.min_cents,
+            max_cents=body.max_cents,
+            enabled=body.enabled,
+            sort_order=body.sort_order,
+            commit=False,
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=404 if "不存在" in str(e) else 400, detail=str(e)) from e
+    write_audit(
+        db, admin, action="ops_marquee_seed.update", target_type="ops_marquee_seed",
+        target_id=seed_id, detail=body.model_dump(exclude_none=True),
+        ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    db.refresh(seed)
+    return _out(seed)
+
+
+@router.delete("/{seed_id}", summary="删轮播种子(带审计)")
+def delete_seed(
+    seed_id: int,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> dict:
+    ok = ops_marquee.delete_seed(db, seed_id, commit=False)
+    if not ok:
+        raise HTTPException(status_code=404, detail="种子不存在")
+    write_audit(
+        db, admin, action="ops_marquee_seed.delete", target_type="ops_marquee_seed",
+        target_id=seed_id, detail=None, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return {"deleted": True}

app/admin/routers/ops_stat_config.py

@@ -0,0 +1,74 @@
+"""admin 首页三统计展示配置:列出三指标配置(+ 真实值预览)+ 改某指标(带审计 + 校验)。
+
+每指标可独立选 real/manual/random。计算逻辑见 app/repositories/ops_stat.py。
+权限:operator 可改(运营调门面数字),super 恒可。
+"""
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
+from app.admin.schemas.ops_stat_config import (
+    OpsStatItemOut,
+    OpsStatUpdateRequest,
+)
+from app.models.admin import AdminUser
+from app.repositories import ops_stat
+
+router = APIRouter(
+    prefix="/admin/api/dashboard-display",
+    tags=["admin-dashboard-display"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get("", response_model=list[OpsStatItemOut], summary="首页三统计配置 + 真实值预览")
+def list_display(db: AdminDb) -> list[OpsStatItemOut]:
+    return [OpsStatItemOut(**item) for item in ops_stat.get_config(db)]
+
+
+@router.patch(
+    "/{metric}", response_model=OpsStatItemOut, summary="改某指标展示配置(带审计)"
+)
+def update_display(
+    metric: str,
+    body: OpsStatUpdateRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OpsStatItemOut:
+    try:
+        before, after = ops_stat.update_config(
+            db,
+            metric,
+            mode=body.mode,
+            manual_value=body.manual_value,
+            random_mult_min=body.random_mult_min,
+            random_mult_max=body.random_mult_max,
+            random_tick_seconds=body.random_tick_seconds,
+            random_anchor_minutes=body.random_anchor_minutes,
+            random_kind=body.random_kind,
+            random_step_min=body.random_step_min,
+            random_step_max=body.random_step_max,
+            real_offset=body.real_offset,
+            allow_decrease=body.allow_decrease,
+            random_initial=body.random_initial,
+            apply_now=body.apply_now,
+            admin_id=admin.id,
+            commit=False,
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e)) from e
+
+    write_audit(
+        db, admin, action="ops_stat_config.set", target_type="ops_stat_config",
+        target_id=metric, detail={"before": before, "after": after},
+        ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+
+    item = next(it for it in ops_stat.get_config(db) if it["metric"] == metric)
+    return OpsStatItemOut(**item)

app/admin/routers/price_report.py

@@ -0,0 +1,107 @@
+"""admin 上报更低价审核:列表 + 统计(读)+ 通过(发金币)/拒绝(写,带审计)。
+
+数据由客户端 POST /api/v1/report 写入 price_report 表(提交即 pending);本路由是运营后台
+对它的人工审核窗口。**通过** → 给上报用户钱包发固定金币(PRICE_REPORT_REWARD_COINS):
+改状态 + 发金币(wallet.grant_coins)+ 审计同一事务一起 commit(原子,仿 users.grant_user_coins),
+绝不只改状态不发钱或反之。客户端轮询 GET /api/v1/report/records 自动看到结果(无需推送)。
+"""
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
+from app.admin.repositories import mutations, queries
+from app.admin.schemas.common import CursorPage, OkResponse
+from app.admin.schemas.price_report import (
+    PriceReportOut,
+    PriceReportRejectRequest,
+    PriceReportSummary,
+)
+from app.core.rewards import PRICE_REPORT_REWARD_COINS
+from app.models.admin import AdminUser
+from app.models.price_report import PriceReport
+from app.repositories import wallet as wallet_repo
+
+router = APIRouter(
+    prefix="/admin/api/price-reports",
+    tags=["admin-price-report"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get("", response_model=CursorPage[PriceReportOut], summary="上报更低价列表(筛选+分页)")
+def list_price_reports(
+    db: AdminDb,
+    status: Annotated[str | None, Query()] = None,
+    user_id: Annotated[int | None, Query()] = None,
+    limit: Annotated[int, Query(ge=1, le=100)] = 20,
+    cursor: Annotated[int | None, Query()] = None,
+) -> CursorPage[PriceReportOut]:
+    items, next_cursor, total = queries.list_price_reports(
+        db, status=status, user_id=user_id, limit=limit, cursor=cursor,
+    )
+    return CursorPage(
+        items=[PriceReportOut.model_validate(r) for r in items],
+        next_cursor=next_cursor,
+        total=total,
+    )
+
+
+@router.get("/summary", response_model=PriceReportSummary, summary="上报审核统计(各状态计数)")
+def price_report_summary(db: AdminDb) -> PriceReportSummary:
+    return PriceReportSummary.model_validate(queries.price_report_summary(db))
+
+
+@router.post("/{report_id}/approve", response_model=OkResponse, summary="通过上报(发固定金币)")
+def approve_price_report(
+    report_id: int,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OkResponse:
+    # 行锁(SELECT FOR UPDATE):并发/连点双请求会都读到 pending → 各发一次金币双倍发奖,
+    # 锁住该行串行化,第二个请求拿锁后看到 approved → 走 400。SQLite 下 FOR UPDATE 为 no-op。
+    rep = db.get(PriceReport, report_id, with_for_update=True)
+    if rep is None:
+        raise HTTPException(status_code=404, detail="上报记录不存在")
+    if rep.status != "pending":
+        raise HTTPException(status_code=400, detail=f"该上报已审核过(当前 {rep.status}),不可重复操作")
+    coins = PRICE_REPORT_REWARD_COINS
+    # 改状态 + 发金币 + 审计同一事务(commit=False),最后一起 commit:改了就有痕、发了就留账
+    mutations.review_price_report(db, rep, status="approved", reward_coins=coins, commit=False)
+    wallet_repo.grant_coins(
+        db, rep.user_id, coins,
+        biz_type="price_report_reward", ref_id=str(rep.id), remark="上报更低价审核通过",
+    )
+    write_audit(
+        db, admin, action="price_report.approve", target_type="price_report", target_id=report_id,
+        detail={"reward_coins": coins, "user_id": rep.user_id}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()
+
+
+@router.post("/{report_id}/reject", response_model=OkResponse, summary="拒绝上报")
+def reject_price_report(
+    report_id: int,
+    body: PriceReportRejectRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OkResponse:
+    rep = db.get(PriceReport, report_id, with_for_update=True)  # 行锁,同 approve(防并发重复审核)
+    if rep is None:
+        raise HTTPException(status_code=404, detail="上报记录不存在")
+    if rep.status != "pending":
+        raise HTTPException(status_code=400, detail=f"该上报已审核过(当前 {rep.status}),不可重复操作")
+    reason = body.reason.strip()
+    mutations.review_price_report(db, rep, status="rejected", reject_reason=reason, commit=False)
+    write_audit(
+        db, admin, action="price_report.reject", target_type="price_report", target_id=report_id,
+        detail={"reason": reason, "user_id": rep.user_id}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()

app/admin/routers/users.py

@@ -0,0 +1,216 @@
+"""admin 用户管理:列表 + 360 详情(读)+ 封禁/解封 + 手动调金币(写,带审计)。"""
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
+from app.admin.repositories import mutations, queries
+from app.admin.schemas.common import CursorPage, OkResponse
+from app.admin.schemas.user import (
+    AdminUserListItem,
+    AdminUserOverview,
+    GrantCashRequest,
+    GrantCoinsRequest,
+    SetDebugTraceRequest,
+    SetUserStatusRequest,
+)
+from app.models.admin import AdminUser
+from app.repositories import user as user_repo
+from app.repositories import wallet as wallet_repo
+
+router = APIRouter(
+    prefix="/admin/api/users",
+    tags=["admin-users"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get("", response_model=CursorPage[AdminUserListItem], summary="用户列表(筛选+排序+分页)")
+def list_users(
+    db: AdminDb,
+    phone: Annotated[str | None, Query()] = None,
+    register_channel: Annotated[str | None, Query()] = None,
+    status: Annotated[str | None, Query()] = None,
+    nickname: Annotated[str | None, Query(max_length=100)] = None,
+    created_from: Annotated[datetime | None, Query()] = None,
+    created_to: Annotated[datetime | None, Query()] = None,
+    last_login_from: Annotated[datetime | None, Query()] = None,
+    last_login_to: Annotated[datetime | None, Query()] = None,
+    sort_by: Annotated[str, Query(pattern="^(id|created_at|last_login_at)$")] = "id",
+    sort_order: Annotated[str, Query(pattern="^(asc|desc)$")] = "desc",
+    limit: Annotated[int, Query(ge=1, le=100)] = 20,
+    cursor: Annotated[int | None, Query()] = None,
+) -> CursorPage[AdminUserListItem]:
+    items, next_cursor, total = queries.list_users(
+        db, phone=phone, register_channel=register_channel, status=status,
+        nickname=nickname, created_from=created_from, created_to=created_to,
+        last_login_from=last_login_from, last_login_to=last_login_to,
+        sort_by=sort_by, sort_order=sort_order, limit=limit, cursor=cursor,
+    )
+    return CursorPage(
+        items=[AdminUserListItem.model_validate(u) for u in items],
+        next_cursor=next_cursor,
+        total=total,
+    )
+
+
+@router.get("/{user_id}", response_model=AdminUserOverview, summary="用户 360 详情")
+def get_user(user_id: int, db: AdminDb) -> AdminUserOverview:
+    overview = queries.get_user_overview(db, user_id)
+    if overview is None:
+        raise HTTPException(status_code=404, detail="用户不存在")
+    return AdminUserOverview.model_validate(overview)
+
+
+@router.post("/{user_id}/status", response_model=OkResponse, summary="封禁/解封用户")
+def set_user_status(
+    user_id: int,
+    body: SetUserStatusRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OkResponse:
+    user = user_repo.get_user_by_id(db, user_id)
+    if user is None:
+        raise HTTPException(status_code=404, detail="用户不存在")
+    if user.status == "deleted":
+        raise HTTPException(status_code=400, detail="已注销账号不可改状态")
+    before = user.status
+    # 业务写 + 审计写同一事务(commit=False),最后一起 commit:改了就有痕、有痕就真改了
+    mutations.set_user_status(db, user, status=body.status, commit=False)
+    write_audit(
+        db, admin, action="user.status.set", target_type="user", target_id=user_id,
+        detail={"before": before, "after": body.status}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()
+
+
+@router.post("/{user_id}/debug-trace", response_model=OkResponse, summary="开关调试链接权限")
+def set_user_debug_trace(
+    user_id: int,
+    body: SetDebugTraceRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OkResponse:
+    user = user_repo.get_user_by_id(db, user_id)
+    if user is None:
+        raise HTTPException(status_code=404, detail="用户不存在")
+    before = user.debug_trace_enabled
+    # 业务写 + 审计写同一事务(commit=False),最后一起 commit(同 set_user_status)
+    mutations.set_user_debug_trace(db, user, enabled=body.enabled, commit=False)
+    write_audit(
+        db, admin, action="user.debug_trace.set", target_type="user", target_id=user_id,
+        detail={"before": before, "after": body.enabled}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()
+
+
+@router.post("/{user_id}/coins", response_model=OkResponse, summary="手动增减/设值金币(带审计)")
+def grant_user_coins(
+    user_id: int,
+    body: GrantCoinsRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("finance"))],
+    db: AdminDb,
+) -> OkResponse:
+    user = user_repo.get_user_by_id(db, user_id)
+    if user is None:
+        raise HTTPException(status_code=404, detail="用户不存在")
+    # set=设为目标值:读当前余额算出要写的差值,仍复用 grant_coins 写一笔流水(沿用原子/审计/扣负保护)
+    if body.mode == "set":
+        if body.amount < 0:
+            raise HTTPException(status_code=400, detail="目标金币值不能为负")
+        # lock=True:锁账户行,防连点/并发各读同一 before 算同一 delta 双写,余额错位
+        before = wallet_repo.get_or_create_account(db, user_id, commit=False, lock=True).coin_balance
+        delta = body.amount - before
+        if delta == 0:
+            raise HTTPException(status_code=400, detail=f"当前金币已为 {body.amount},无需调整")
+    else:
+        if body.amount == 0:
+            raise HTTPException(status_code=400, detail="amount 不能为 0")
+        delta = body.amount
+        # 负数扣减时不允许扣成负余额(运营误操作保护);lock=True 防并发扣穿
+        if delta < 0:
+            acc_now = wallet_repo.get_or_create_account(db, user_id, commit=False, lock=True)
+            if acc_now.coin_balance + delta < 0:
+                raise HTTPException(
+                    status_code=400, detail=f"扣减后金币为负(当前余额 {acc_now.coin_balance})"
+                )
+    biz_type = "admin_grant" if delta > 0 else "admin_deduct"
+    # grant_coins 只 flush 不 commit;审计同 commit=False;最后一起 commit → 原子(改钱+留痕)
+    acc, _ = wallet_repo.grant_coins(
+        db, user_id, delta, biz_type=biz_type, remark=f"admin:{body.reason}"[:128],
+    )
+    detail = {"amount": delta, "balance_after": acc.coin_balance, "reason": body.reason}
+    if body.mode == "set":
+        detail.update({"mode": "set", "target": body.amount, "before": before})
+    write_audit(
+        db, admin, action="user.coins.grant", target_type="user", target_id=user_id,
+        detail=detail, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()
+
+
+@router.post("/{user_id}/cash", response_model=OkResponse, summary="手动增减/设值现金(带审计)")
+def grant_user_cash(
+    user_id: int,
+    body: GrantCashRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("finance"))],
+    db: AdminDb,
+) -> OkResponse:
+    """给指定用户增/减或设值现金(分)。delta:正=发放、负=扣减;set:直接设为目标值。
+    主要用于让无现金用户直接测试提现。"""
+    user = user_repo.get_user_by_id(db, user_id)
+    if user is None:
+        raise HTTPException(status_code=404, detail="用户不存在")
+    # set=设为目标值:读当前余额算差值,仍复用 grant_cash 写一笔流水(沿用原子/审计/扣负保护)
+    if body.mode == "set":
+        if body.amount_cents < 0:
+            raise HTTPException(status_code=400, detail="目标现金值不能为负")
+        # lock=True:锁账户行,防连点/并发各读同一 before 算同一 delta 双写,余额错位
+        before = wallet_repo.get_or_create_account(
+            db, user_id, commit=False, lock=True
+        ).cash_balance_cents
+        delta = body.amount_cents - before
+        if delta == 0:
+            raise HTTPException(
+                status_code=400, detail=f"当前现金已为 {body.amount_cents} 分,无需调整"
+            )
+    else:
+        if body.amount_cents == 0:
+            raise HTTPException(status_code=400, detail="amount_cents 不能为 0")
+        delta = body.amount_cents
+        # 负数扣减时不允许扣成负余额(运营误操作保护);lock=True 防并发扣穿
+        if delta < 0:
+            acc_now = wallet_repo.get_or_create_account(db, user_id, commit=False, lock=True)
+            if acc_now.cash_balance_cents + delta < 0:
+                raise HTTPException(
+                    status_code=400, detail=f"扣减后现金为负(当前余额 {acc_now.cash_balance_cents} 分)"
+                )
+    biz_type = "admin_grant" if delta > 0 else "admin_deduct"
+    # grant_cash 只 flush 不 commit;审计同 commit=False;最后一起 commit → 原子(改钱+留痕)
+    acc, _ = wallet_repo.grant_cash(
+        db, user_id, delta, biz_type=biz_type, remark=f"admin:{body.reason}"[:128],
+    )
+    detail = {
+        "amount_cents": delta,
+        "balance_after_cents": acc.cash_balance_cents,
+        "reason": body.reason,
+    }
+    if body.mode == "set":
+        detail.update({"mode": "set", "target_cents": body.amount_cents, "before_cents": before})
+    write_audit(
+        db, admin, action="user.cash.grant", target_type="user", target_id=user_id,
+        detail=detail, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()

app/admin/routers/wallet.py

@@ -0,0 +1,49 @@
+"""admin 钱包:金币流水 + 现金流水(跨用户,可按 user_id 过滤)。手动调金币见 M3。"""
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Query
+
+from app.admin.deps import AdminDb, get_current_admin
+from app.admin.repositories import queries
+from app.admin.schemas.common import CursorPage
+from app.admin.schemas.wallet import CashTxnOut, CoinTxnOut
+
+router = APIRouter(
+    prefix="/admin/api/wallet",
+    tags=["admin-wallet"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get("/coin-transactions", response_model=CursorPage[CoinTxnOut], summary="金币流水")
+def coin_transactions(
+    db: AdminDb,
+    user_id: Annotated[int | None, Query()] = None,
+    biz_type: Annotated[str | None, Query()] = None,
+    limit: Annotated[int, Query(ge=1, le=100)] = 20,
+    cursor: Annotated[int | None, Query()] = None,
+) -> CursorPage[CoinTxnOut]:
+    items, next_cursor = queries.list_all_coin_transactions(
+        db, user_id=user_id, biz_type=biz_type, limit=limit, cursor=cursor,
+    )
+    return CursorPage(
+        items=[CoinTxnOut.model_validate(t) for t in items], next_cursor=next_cursor,
+    )
+
+
+@router.get("/cash-transactions", response_model=CursorPage[CashTxnOut], summary="现金流水")
+def cash_transactions(
+    db: AdminDb,
+    user_id: Annotated[int | None, Query()] = None,
+    biz_type: Annotated[str | None, Query()] = None,
+    limit: Annotated[int, Query(ge=1, le=100)] = 20,
+    cursor: Annotated[int | None, Query()] = None,
+) -> CursorPage[CashTxnOut]:
+    items, next_cursor = queries.list_all_cash_transactions(
+        db, user_id=user_id, biz_type=biz_type, limit=limit, cursor=cursor,
+    )
+    return CursorPage(
+        items=[CashTxnOut.model_validate(t) for t in items], next_cursor=next_cursor,
+    )

app/admin/routers/withdraw.py

@@ -0,0 +1,447 @@
+"""admin 提现:列表(读)+ 单笔重试查单 + 批量对账(写,带审计)。
+
+提现的钱逻辑(查微信/退款/撤单/幂等)全部复用 app.repositories.wallet,admin 只触发 + 记审计。
+这些 wallet 函数内部各自 commit(涉及微信调用),审计在其后单独 commit:操作本身幂等,
+审计记录"谁触发的 + 结果",事务边界比"改金币"宽松是有意的(不能塞进 wallet 的自有事务)。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
+from app.admin.repositories import queries
+from app.admin.schemas.common import CursorPage
+from app.admin.schemas.admin import AdminAuditLogOut
+from app.admin.schemas.wallet import (
+    CashTxnOut,
+    ReconcileResult,
+    WithdrawBulkRejectRequest,
+    WithdrawBulkRequest,
+    WithdrawBulkResult,
+    WithdrawBulkItemResult,
+    WithdrawDetailOut,
+    WithdrawLedgerCheckOut,
+    WithdrawOrderOut,
+    WithdrawRejectRequest,
+    WithdrawSummaryOut,
+    WithdrawUserSnapshot,
+    WxpayHealthCheckOut,
+)
+from app.core.config import settings
+from app.integrations import wxpay
+from app.models.admin import AdminUser
+from app.repositories import wallet as wallet_repo
+
+router = APIRouter(
+    prefix="/admin/api/withdraws",
+    tags=["admin-withdraw"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get("", response_model=CursorPage[WithdrawOrderOut], summary="提现单列表")
+def list_withdraws(
+    db: AdminDb,
+    user_id: Annotated[int | None, Query()] = None,
+    status: Annotated[str | None, Query()] = None,
+    keyword: Annotated[str | None, Query(max_length=100)] = None,
+    date_from: Annotated[datetime | None, Query()] = None,
+    date_to: Annotated[datetime | None, Query()] = None,
+    date_field: Annotated[str, Query(pattern="^(created_at|updated_at)$")] = "created_at",
+    sort_by: Annotated[
+        str, Query(pattern="^(id|created_at|updated_at|amount_cents)$")
+    ] = "created_at",
+    sort_order: Annotated[str, Query(pattern="^(asc|desc)$")] = "desc",
+    quick_filter: Annotated[
+        str | None,
+        Query(pattern="^(abnormal|failed|overdue_reviewing|pending_overdue|today|high_risk)$"),
+    ] = None,
+    limit: Annotated[int, Query(ge=1, le=100)] = 20,
+    cursor: Annotated[int | None, Query()] = None,
+) -> CursorPage[WithdrawOrderOut]:
+    items, next_cursor, total = queries.list_all_withdraw_orders(
+        db,
+        user_id=user_id,
+        status=status,
+        keyword=keyword,
+        date_from=date_from,
+        date_to=date_to,
+        date_field=date_field,
+        sort_by=sort_by,
+        sort_order=sort_order,
+        quick_filter=quick_filter,
+        limit=limit,
+        cursor=cursor,
+    )
+    return CursorPage(
+        items=[WithdrawOrderOut.model_validate(o) for o in items],
+        next_cursor=next_cursor,
+        total=total,
+    )
+
+
+@router.get("/summary", response_model=WithdrawSummaryOut, summary="提现审核台统计")
+def withdraws_summary(db: AdminDb) -> WithdrawSummaryOut:
+    return WithdrawSummaryOut(**queries.withdraw_summary(db))
+
+
+@router.get(
+    "/health-check",
+    response_model=WxpayHealthCheckOut,
+    summary="提现配置健康检查",
+    dependencies=[Depends(require_role("finance"))],  # 暴露密钥路径/配置,限财务+super
+)
+def withdraw_health_check() -> WxpayHealthCheckOut:
+    private_path = wxpay._resolve_config_path(settings.WXPAY_MCH_PRIVATE_KEY_PATH)  # noqa: SLF001
+    public_path = wxpay._resolve_config_path(settings.WXPAY_PUBLIC_KEY_PATH)  # noqa: SLF001
+    issues: list[str] = []
+
+    private_loadable = False
+    public_loadable = False
+    try:
+        wxpay._load_private_key()  # noqa: SLF001
+        private_loadable = True
+    except Exception as e:  # noqa: BLE001
+        issues.append(f"商户私钥不可用:{e}")
+    try:
+        wxpay._load_public_key()  # noqa: SLF001
+        public_loadable = True
+    except Exception as e:  # noqa: BLE001
+        issues.append(f"微信支付平台公钥不可用:{e}")
+
+    if not settings.wxpay_configured:
+        issues.append("微信支付基础配置不完整")
+    if not settings.WXPAY_AUTH_NOTIFY_URL:
+        issues.append("免确认授权回调地址未配置")
+    if not settings.WITHDRAW_AUTO_RECONCILE_ENABLED:
+        issues.append("自动对账未开启")
+
+    return WxpayHealthCheckOut(
+        ok=not issues,
+        wxpay_configured=settings.wxpay_configured,
+        wxpay_auth_configured=settings.wxpay_auth_configured,
+        private_key_path=str(private_path),
+        private_key_exists=private_path.exists(),
+        private_key_loadable=private_loadable,
+        public_key_path=str(public_path),
+        public_key_exists=public_path.exists(),
+        public_key_loadable=public_loadable,
+        auth_notify_url_configured=bool(settings.WXPAY_AUTH_NOTIFY_URL),
+        auto_reconcile_enabled=settings.WITHDRAW_AUTO_RECONCILE_ENABLED,
+        auto_reconcile_interval_sec=settings.WITHDRAW_AUTO_RECONCILE_INTERVAL_SEC,
+        auto_reconcile_older_than_minutes=settings.WITHDRAW_AUTO_RECONCILE_OLDER_THAN_MINUTES,
+        issues=issues,
+    )
+
+
+@router.get("/ledger-check", response_model=WithdrawLedgerCheckOut, summary="提现资金账本校验")
+def withdraw_ledger_check(db: AdminDb) -> WithdrawLedgerCheckOut:
+    return WithdrawLedgerCheckOut(**queries.withdraw_ledger_check(db))
+
+
+@router.get("/{out_bill_no}", response_model=WithdrawDetailOut, summary="提现单详情")
+def withdraw_detail(out_bill_no: str, db: AdminDb) -> WithdrawDetailOut:
+    order = queries.get_withdraw_by_out_bill_no(db, out_bill_no)
+    if order is None:
+        raise HTTPException(status_code=404, detail="提现单不存在")
+
+    overview = queries.get_user_overview(db, order.user_id)
+    user_snapshot = None
+    if overview is not None:
+        user = overview["user"]
+        user_snapshot = WithdrawUserSnapshot(
+            id=user.id,
+            phone=user.phone,
+            nickname=user.nickname,
+            status=user.status,
+            wechat_nickname=user.wechat_nickname,
+            wechat_avatar_url=user.wechat_avatar_url,
+            created_at=user.created_at,
+            last_login_at=user.last_login_at,
+            cash_balance_cents=overview["cash_balance_cents"],
+            withdraw_total=overview["withdraw_total"],
+            withdraw_success_cents=overview["withdraw_success_cents"],
+        )
+
+    recent_withdraws, _, _ = queries.list_all_withdraw_orders(
+        db, user_id=order.user_id, limit=5, cursor=None,
+    )
+    recent_cash_transactions, _ = queries.list_all_cash_transactions(
+        db, user_id=order.user_id, limit=8, cursor=None,
+    )
+    audit_logs = queries.list_withdraw_audit_logs(db, out_bill_no, limit=10)
+    risk_flags, risk_score = queries.withdraw_risk_flags(
+        order,
+        overview["user"] if overview else None,
+        recent_withdraws,
+        overview["cash_balance_cents"] if overview else 0,
+    )
+
+    return WithdrawDetailOut(
+        order=WithdrawOrderOut.model_validate(order),
+        user=user_snapshot,
+        risk_flags=risk_flags,
+        risk_score=risk_score,
+        recent_withdraws=[WithdrawOrderOut.model_validate(o) for o in recent_withdraws],
+        recent_cash_transactions=[CashTxnOut.model_validate(t) for t in recent_cash_transactions],
+        audit_logs=[AdminAuditLogOut.model_validate(log) for log in audit_logs],
+    )
+
+
+# 注意:/reconcile 必须在 /{out_bill_no}/refresh 之前声明(静态路径优先于路径参数)
+@router.post("/reconcile", response_model=ReconcileResult, summary="批量对账(扫超时 pending 单)")
+def reconcile(
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("finance"))],
+    db: AdminDb,
+    older_than_minutes: Annotated[int, Query(ge=0)] = 15,
+) -> ReconcileResult:
+    try:
+        result = wallet_repo.reconcile_pending_withdraws(db, older_than_minutes=older_than_minutes)
+    except wxpay.WxPayNotConfiguredError as e:
+        raise HTTPException(status_code=503, detail="微信支付未配置") from e
+    write_audit(
+        db, admin, action="withdraw.reconcile", target_type="withdraw", target_id=None,
+        detail=result, ip=get_client_ip(request), commit=True,
+    )
+    return ReconcileResult(**result)
+
+
+def _bulk_result(items: list[WithdrawBulkItemResult]) -> WithdrawBulkResult:
+    success = sum(1 for item in items if item.ok)
+    return WithdrawBulkResult(
+        total=len(items),
+        success=success,
+        failed=len(items) - success,
+        items=items,
+    )
+
+
+@router.post("/bulk/refresh", response_model=WithdrawBulkResult, summary="批量刷新查单")
+def bulk_refresh_withdraws(
+    body: WithdrawBulkRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("finance"))],
+    db: AdminDb,
+) -> WithdrawBulkResult:
+    results: list[WithdrawBulkItemResult] = []
+    ip = get_client_ip(request)
+    for out_bill_no in body.out_bill_nos:
+        try:
+            order = queries.get_withdraw_by_out_bill_no(db, out_bill_no)
+            if order is None:
+                raise wallet_repo.WithdrawOrderNotFound
+            refreshed = wallet_repo.refresh_withdraw_status(
+                db, order.user_id, out_bill_no, cancel_if_unconfirmed=True,
+            )
+            write_audit(
+                db, admin, action="withdraw.refresh", target_type="withdraw",
+                target_id=out_bill_no,
+                detail={
+                    "status": refreshed.status,
+                    "wechat_state": refreshed.wechat_state,
+                    "fail_reason": refreshed.fail_reason,
+                    "bulk": True,
+                },
+                ip=ip, commit=True,
+            )
+            results.append(
+                WithdrawBulkItemResult(
+                    out_bill_no=out_bill_no, ok=True, status=refreshed.status
+                )
+            )
+        except wallet_repo.WithdrawOrderNotFound:
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error="提现单不存在")
+            )
+        except wxpay.WxPayNotConfiguredError:
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error="微信支付未配置")
+            )
+        except Exception as e:  # noqa: BLE001 - 批量操作单笔失败不打断整批
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error=f"系统异常: {e}")
+            )
+    return _bulk_result(results)
+
+
+@router.post("/bulk/approve", response_model=WithdrawBulkResult, summary="批量审核通过并打款")
+def bulk_approve_withdraws(
+    body: WithdrawBulkRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("finance"))],
+    db: AdminDb,
+) -> WithdrawBulkResult:
+    results: list[WithdrawBulkItemResult] = []
+    ip = get_client_ip(request)
+    for out_bill_no in body.out_bill_nos:
+        try:
+            order = wallet_repo.approve_withdraw(db, out_bill_no)
+            write_audit(
+                db, admin, action="withdraw.approve", target_type="withdraw",
+                target_id=out_bill_no,
+                detail={
+                    "status": order.status,
+                    "wechat_state": order.wechat_state,
+                    "amount_cents": order.amount_cents,
+                    "bulk": True,
+                },
+                ip=ip, commit=True,
+            )
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=True, status=order.status)
+            )
+        except wallet_repo.WithdrawOrderNotFound:
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error="提现单不存在")
+            )
+        except wallet_repo.WithdrawNotReviewable as e:
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error=str(e))
+            )
+        except wxpay.WxPayNotConfiguredError:
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error="微信支付未配置")
+            )
+        except Exception as e:  # noqa: BLE001 - 批量操作单笔失败不打断整批
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error=f"系统异常: {e}")
+            )
+    return _bulk_result(results)
+
+
+@router.post("/bulk/reject", response_model=WithdrawBulkResult, summary="批量审核拒绝并退款")
+def bulk_reject_withdraws(
+    body: WithdrawBulkRejectRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("finance"))],
+    db: AdminDb,
+) -> WithdrawBulkResult:
+    results: list[WithdrawBulkItemResult] = []
+    ip = get_client_ip(request)
+    for out_bill_no in body.out_bill_nos:
+        try:
+            order = wallet_repo.reject_withdraw(db, out_bill_no, body.reason)
+            write_audit(
+                db, admin, action="withdraw.reject", target_type="withdraw",
+                target_id=out_bill_no,
+                detail={
+                    "reason": body.reason,
+                    "amount_cents": order.amount_cents,
+                    "bulk": True,
+                },
+                ip=ip, commit=True,
+            )
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=True, status=order.status)
+            )
+        except wallet_repo.WithdrawOrderNotFound:
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error="提现单不存在")
+            )
+        except wallet_repo.WithdrawNotReviewable as e:
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error=str(e))
+            )
+        except Exception as e:  # noqa: BLE001 - 批量操作单笔失败不打断整批
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error=f"系统异常: {e}")
+            )
+    return _bulk_result(results)
+
+
+@router.post("/{out_bill_no}/refresh", response_model=WithdrawOrderOut, summary="单笔重试查单")
+def refresh_withdraw(
+    out_bill_no: str,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("finance"))],
+    db: AdminDb,
+) -> WithdrawOrderOut:
+    order = queries.get_withdraw_by_out_bill_no(db, out_bill_no)
+    if order is None:
+        raise HTTPException(status_code=404, detail="提现单不存在")
+    try:
+        refreshed = wallet_repo.refresh_withdraw_status(
+            db, order.user_id, out_bill_no, cancel_if_unconfirmed=True,
+        )
+    except wxpay.WxPayNotConfiguredError as e:
+        raise HTTPException(status_code=503, detail="微信支付未配置") from e
+    write_audit(
+        db, admin, action="withdraw.refresh", target_type="withdraw", target_id=out_bill_no,
+        detail={
+            "status": refreshed.status,
+            "wechat_state": refreshed.wechat_state,
+            "fail_reason": refreshed.fail_reason,
+        },
+        ip=get_client_ip(request), commit=True,
+    )
+    return WithdrawOrderOut.model_validate(refreshed)
+
+
+@router.post("/{out_bill_no}/approve", response_model=WithdrawOrderOut, summary="审核通过(发起微信打款)")
+def approve_withdraw_order(
+    out_bill_no: str,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("finance"))],
+    db: AdminDb,
+) -> WithdrawOrderOut:
+    """审核通过 → 调微信转账。仅 reviewing 单可通过(非 reviewing 返 409,防重复打款)。
+
+    打款的钱逻辑(转账/查单/退款/幂等)复用 wallet_repo.approve_withdraw → execute_withdraw_transfer;
+    返回的 order 可能是 pending(在途/待用户确认)/success/failed(打款失败已退),admin 前端按 status 展示。
+    """
+    try:
+        order = wallet_repo.approve_withdraw(db, out_bill_no)
+    except wallet_repo.WithdrawOrderNotFound as e:
+        raise HTTPException(status_code=404, detail="提现单不存在") from e
+    except wallet_repo.WithdrawNotReviewable as e:
+        raise HTTPException(status_code=409, detail=str(e)) from e
+    except wxpay.WxPayNotConfiguredError as e:
+        raise HTTPException(status_code=503, detail="微信支付未配置") from e
+    write_audit(
+        db, admin, action="withdraw.approve", target_type="withdraw", target_id=out_bill_no,
+        detail={
+            "status": order.status,
+            "wechat_state": order.wechat_state,
+            "amount_cents": order.amount_cents,
+        },
+        ip=get_client_ip(request), commit=True,
+    )
+    return WithdrawOrderOut.model_validate(order)
+
+
+@router.post("/{out_bill_no}/reject", response_model=WithdrawOrderOut, summary="审核拒绝(退回现金)")
+def reject_withdraw_order(
+    out_bill_no: str,
+    body: WithdrawRejectRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("finance"))],
+    db: AdminDb,
+) -> WithdrawOrderOut:
+    """审核拒绝 → 退回用户现金 + 置 rejected,理由写入 fail_reason(用户可见)。仅 reviewing 单可拒。"""
+    try:
+        order = wallet_repo.reject_withdraw(db, out_bill_no, body.reason)
+    except wallet_repo.WithdrawOrderNotFound as e:
+        raise HTTPException(status_code=404, detail="提现单不存在") from e
+    except wallet_repo.WithdrawNotReviewable as e:
+        raise HTTPException(status_code=409, detail=str(e)) from e
+    write_audit(
+        db, admin, action="withdraw.reject", target_type="withdraw", target_id=out_bill_no,
+        detail={"reason": body.reason, "amount_cents": order.amount_cents},
+        ip=get_client_ip(request), commit=True,
+    )
+    return WithdrawOrderOut.model_validate(order)

app/admin/schemas/__init__.py

@@ -0,0 +1 @@
+"""admin 请求/响应 schemas(snake_case,与前端约定一致)。"""

app/admin/schemas/ad_audit.py

@@ -0,0 +1,62 @@
+"""看广告金币审计 schemas。
+
+只读对账视图:把"看视频"(ad_reward_record)和"信息流"(ad_feed_reward_record)两类发奖记录,
+用与正式发奖相同的公式 [app.core.rewards.calculate_ad_reward_coin] 复算一遍 expected_coin,
+和实际入账的 actual_coin 对比,核对金币公式是否生效。字段 snake_case、金额按金币整数。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from pydantic import BaseModel, Field
+
+
+class AdCoinAuditRow(BaseModel):
+    """单条发奖记录的复算明细。"""
+
+    scene: str = Field(..., description="reward_video(看视频) / feed(信息流)")
+    record_id: int = Field(..., description="对应记录表主键")
+    user_id: int
+    created_at: datetime
+    status: str = Field(..., description="granted / capped / ecpm_missing")
+    ecpm: str | None = Field(None, description="本次采用的 eCPM 原始值(分/千次展示,SDK getEcpm 原值)")
+    ecpm_factor: float | None = Field(None, description="因子1(eCPM 档)")
+    units: int = Field(..., description="折算份数:看视频恒为 1;信息流 = 满 10 秒的份数")
+    lt_index_start: int | None = Field(None, description="本条占用的当日第几份(起)")
+    lt_index_end: int | None = Field(None, description="本条占用的当日第几份(止);看视频 = 起")
+    lt_factor_start: float | None = Field(None, description="因子2(LT)起值")
+    lt_factor_end: float | None = Field(None, description="因子2(LT)止值;看视频 = 起值")
+    expected_coin: int = Field(..., description="按公式复算应发金币")
+    actual_coin: int = Field(..., description="实际入账金币")
+    matched: bool = Field(..., description="复算与实发是否一致(capped/ecpm_missing 校验是否确为 0)")
+
+
+class AdCoinFormulaOut(BaseModel):
+    """当前金币公式参数(给前端展示规则参照)。"""
+
+    description: str = Field(
+        "eCPM元 = getEcpm分 ÷ 100;单份金币 = round(eCPM元 ÷ 1000 × 因子1 × 因子2 × coin_per_yuan);"
+        "因子1 按 eCPM元 判档(阈值 100/200/400 元)",
+        description="公式说明",
+    )
+    coin_per_yuan: int = Field(..., description="金币:元 汇率")
+    ecpm_unit: str = Field("分/千次展示(SDK getEcpm 原值)", description="eCPM 口径")
+    feed_unit_seconds: int = Field(..., description="信息流每多少秒折 1 份")
+    # [(因子值, 区间下限, 区间上限或 null)]
+    ecpm_factor_tiers: list[tuple[float, int, int | None]] = Field(..., description="因子1 档位表")
+    lt_factor_tiers: list[tuple[float, int, int | None]] = Field(..., description="因子2 LT 档位表")
+
+
+class AdCoinAuditOut(BaseModel):
+    """审计响应:公式参照 + 全量统计 + 明细。"""
+
+    date: str = Field(..., description="审计日期(北京时间 YYYY-MM-DD)")
+    formula: AdCoinFormulaOut
+    total: int = Field(..., description="该筛选下复算总条数(全量,不受 limit/only_mismatch 影响)")
+    mismatch_count: int = Field(
+        ..., description="全量不一致条数(=0 说明公式全部生效;在截断前统计,可信)"
+    )
+    truncated: bool = Field(
+        ..., description="展示集是否被 limit 截断(true=还有未返回的明细,请缩小范围或调大 limit)"
+    )
+    items: list[AdCoinAuditRow] = Field(..., description="展示明细;only_mismatch=true 时只含 ✗ 行")

app/admin/schemas/admin.py

@@ -0,0 +1,37 @@
+"""admin 账号管理 + 审计日志 schemas。"""
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Literal
+
+from pydantic import BaseModel, ConfigDict, Field
+
+_Role = Literal["super_admin", "finance", "operator"]
+
+
+class AdminCreateRequest(BaseModel):
+    username: str = Field(..., min_length=3, max_length=64)
+    password: str = Field(..., min_length=8, max_length=72)  # bcrypt ≤72 字节
+    role: _Role = "operator"
+
+
+class AdminUpdateRequest(BaseModel):
+    """改角色 / 启用禁用 / 重置密码,字段都可选(只改传了的)。"""
+
+    role: _Role | None = None
+    status: Literal["active", "disabled"] | None = None
+    password: str | None = Field(None, min_length=8, max_length=72)
+
+
+class AdminAuditLogOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    admin_id: int
+    admin_username: str
+    action: str
+    target_type: str
+    target_id: str | None = None
+    detail: dict | None = None
+    ip: str | None = None
+    created_at: datetime

app/admin/schemas/auth.py

@@ -0,0 +1,29 @@
+"""Admin 认证 schemas。"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class AdminLoginRequest(BaseModel):
+    username: str = Field(..., min_length=1, max_length=64)
+    password: str = Field(..., min_length=1, max_length=128)
+
+
+class AdminOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    username: str
+    role: str
+    status: str
+    created_at: datetime
+    last_login_at: datetime | None = None
+
+
+class AdminLoginResponse(BaseModel):
+    access_token: str
+    token_type: str = "Bearer"
+    expires_in: int = Field(..., description="access_token 剩余秒数(过期重新登录)")
+    admin: AdminOut

app/admin/schemas/common.py

@@ -0,0 +1,24 @@
+"""通用 schema:游标分页响应 + 通用 ok 响应。"""
+from __future__ import annotations
+
+from typing import Generic, TypeVar
+
+from pydantic import BaseModel
+
+T = TypeVar("T")
+
+
+class CursorPage(BaseModel, Generic[T]):
+    """分页响应:items + 下一页游标(next_cursor=None 表示末页)+ 可选 total。
+
+    next_cursor:offset 分页时即下一页 offset,「加载更多」用;末页为 None。
+    total:符合筛选条件的总条数,页码分页(antd pagination)用;不需要总数的接口可不传(None)。
+    """
+
+    items: list[T]
+    next_cursor: int | None = None
+    total: int | None = None
+
+
+class OkResponse(BaseModel):
+    ok: bool = True

app/admin/schemas/config.py

@@ -0,0 +1,22 @@
+"""admin 运营配置 schemas。"""
+from __future__ import annotations
+
+from typing import Any
+
+from pydantic import BaseModel
+
+
+class ConfigItemOut(BaseModel):
+    key: str
+    label: str
+    group: str
+    type: str  # int / int_list / dict_str_int
+    help: str | None = None
+    default: Any
+    value: Any
+    overridden: bool  # 是否被运营覆盖过(false=用默认)
+    updated_at: str | None = None
+
+
+class ConfigUpdateRequest(BaseModel):
+    value: Any

app/admin/schemas/dashboard.py

@@ -0,0 +1,56 @@
+"""admin 大盘 schemas(对应 stats.dashboard_overview 的嵌套结构)。"""
+from __future__ import annotations
+
+from pydantic import BaseModel
+
+
+class DashboardUsers(BaseModel):
+    total: int
+    active: int
+    disabled: int
+    deleted: int
+    new_today: int
+    dau: int
+
+
+class DashboardCoins(BaseModel):
+    reward_video_coin_total: int = 0
+    reward_video_watch_count: int = 0
+    feed_ad_coin_total: int = 0
+    feed_ad_watch_count: int = 0
+    signin_coin_total: int = 0
+    signin_count: int = 0
+    signin_boost_coin_total: int = 0
+    signin_boost_watch_count: int = 0
+    granted_total: int
+
+
+class DashboardCash(BaseModel):
+    withdraw_success_cents: int
+    withdraw_pending_count: int
+    withdraw_success_count: int
+    withdraw_failed_count: int
+
+
+class DashboardComparison(BaseModel):
+    total: int
+    success: int
+    success_rate: float
+
+
+class DashboardFeedback(BaseModel):
+    new: int
+
+
+class DashboardCps(BaseModel):
+    available: bool
+    note: str
+
+
+class DashboardOverview(BaseModel):
+    users: DashboardUsers
+    coins: DashboardCoins
+    cash: DashboardCash
+    comparison: DashboardComparison
+    feedback: DashboardFeedback
+    cps: DashboardCps

app/admin/schemas/feedback.py

@@ -0,0 +1,18 @@
+"""admin 反馈工单 schemas。"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict
+
+
+class FeedbackOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    user_id: int
+    content: str
+    contact: str
+    images: list[str] | None = None
+    status: str
+    created_at: datetime

app/admin/schemas/onboarding.py

@@ -0,0 +1,24 @@
+"""admin 设备维度新手引导管理 schemas。
+
+force_onboarding(按用户)废弃后改用「按设备」:直接操作 onboarding_completion(设备+账号 维度),
+客户端任何版本都按它判断是否走引导,故可靠。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from pydantic import BaseModel, Field
+
+
+class DeviceOnboardingItem(BaseModel):
+    """一台设备(ANDROID_ID)的引导聚合:在该设备走过引导的账号数 + 最近完成时间。"""
+
+    device_id: str
+    account_count: int
+    last_completed_at: datetime
+
+
+class ResetAllRequest(BaseModel):
+    confirm: bool = Field(
+        False, description="必须 true 才清空全部设备的引导记录(防误调接口;前端另有二次确认弹窗)"
+    )

app/admin/schemas/ops_marquee_seed.py

@@ -0,0 +1,64 @@
+"""admin 首页轮播种子 schemas。金额单位:分(前端展示 ÷100 取元)。
+
+种子 = 生成规则:masked_user 可空(空→feed 随机合成名)、金额是 [min_cents, max_cents] 区间。
+"""
+from __future__ import annotations
+
+from pydantic import BaseModel, Field
+
+
+class OpsMarqueeSeedOut(BaseModel):
+    id: int
+    masked_user: str | None = None
+    min_cents: int
+    max_cents: int
+    enabled: bool
+    sort_order: int
+    created_at: str | None = None
+
+
+class OpsMarqueeSeedCreate(BaseModel):
+    masked_user: str | None = None  # 空 / 不传 → feed 随机合成脱敏名
+    min_cents: int
+    max_cents: int
+    enabled: bool = True
+    sort_order: int = 0
+
+
+class OpsMarqueeSeedUpdate(BaseModel):
+    # masked_user:不传=不改;传空串=清空(改回随机合成);传值=固定该名
+    masked_user: str | None = None
+    min_cents: int | None = None
+    max_cents: int | None = None
+    enabled: bool | None = None
+    sort_order: int | None = None
+
+
+class OpsMarqueeSeedBulkCreate(BaseModel):
+    """批量生成 count 条自动合成名种子(冷启动铺量)。"""
+    count: int
+    min_cents: int
+    max_cents: int
+    enabled: bool = True
+
+
+class OpsMarqueeSeedBatchDelete(BaseModel):
+    """批量删除选中的种子。"""
+    ids: list[int] = Field(..., max_length=500)  # 上限防超大列表(审计行/IN 子句过大)
+
+
+class OpsMarqueeSeedBatchEnable(BaseModel):
+    """批量启用 / 停用选中的种子。"""
+    ids: list[int] = Field(..., max_length=500)
+    enabled: bool
+
+
+class OpsSavingsFeedPreviewItem(BaseModel):
+    masked_user: str
+    saved_amount_cents: int
+    time: str
+
+
+class OpsSavingsFeedPreviewOut(BaseModel):
+    """运营预览:实际混播出来的 feed(真实记录会插队,与客户端一致)。"""
+    items: list[OpsSavingsFeedPreviewItem]

app/admin/schemas/ops_stat_config.py

@@ -0,0 +1,48 @@
+"""admin 首页三统计展示配置 schemas。
+
+倍率用千分比整数(1.000→1000);total_saved 的 manual_value / random_current 单位是分。
+"""
+from __future__ import annotations
+
+from pydantic import BaseModel
+
+
+class OpsStatItemOut(BaseModel):
+    metric: str  # help_users / total_compares / total_saved
+    label: str  # 帮助用户 / 完成比价 / 累计节省
+    unit: str  # 人 / 次 / 分
+    mode: str  # real / manual / random
+    manual_value: int | None = None
+    random_mult_min: int
+    random_mult_max: int
+    random_tick_seconds: int
+    random_anchor_minutes: int
+    random_kind: str  # mult(×倍率) / add(+绝对增量)
+    random_step_min: int  # 绝对增量区间(基础单位;total_saved 为分)
+    random_step_max: int
+    real_offset: int  # 真实值模式保底值(基础单位):展示=max(真实,保底)。列名沿用 real_offset
+    allow_decrease: bool  # 是否允许展示值下降(默认 false = 只增不减)
+    random_current: int | None = None
+    random_last_tick_at: str | None = None
+    real_value: int  # 当前真实值(纯真实、不含偏移;给运营对比参考)
+    updated_at: str | None = None
+
+
+class OpsStatUpdateRequest(BaseModel):
+    """改某指标配置(均可选,只改传了的字段)。"""
+
+    mode: str | None = None
+    manual_value: int | None = None
+    random_mult_min: int | None = None
+    random_mult_max: int | None = None
+    random_tick_seconds: int | None = None
+    random_anchor_minutes: int | None = None
+    random_kind: str | None = None  # mult / add
+    random_step_min: int | None = None
+    random_step_max: int | None = None
+    real_offset: int | None = None
+    allow_decrease: bool | None = None
+    # 切 random 时的初始基数;不传则用当前真实值播种
+    random_initial: int | None = None
+    # 立即更新:不等更新钟点,保存后马上把展示值刷新一次(real 快照/manual 生效/random 走一档)
+    apply_now: bool = False

app/admin/schemas/price_report.py

@@ -0,0 +1,54 @@
+"""admin 上报更低价审核 schemas。"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator
+
+
+class PriceReportOut(BaseModel):
+    """admin 列表项:price_report 全字段(审核要看的快照 + 截图 + 状态 + 奖励)。"""
+
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    user_id: int
+    comparison_record_id: int | None = None
+    # 选中比价记录的快照
+    store_name: str | None = None
+    dish_summary: str | None = None
+    original_platform_id: str | None = None
+    original_platform_name: str | None = None
+    original_price_cents: int | None = None
+    # 用户上报的更低价
+    reported_platform_id: str
+    reported_platform_name: str
+    reported_price_cents: int
+    images: list[str] = []
+    # 审核
+    status: str
+    reject_reason: str | None = None
+    reward_coins: int | None = None
+    reviewed_at: datetime | None = None
+    created_at: datetime
+
+
+class PriceReportRejectRequest(BaseModel):
+    reason: str = Field(min_length=1, max_length=256, description="拒绝理由,用户端记录页会看到")
+
+    @field_validator("reason")
+    @classmethod
+    def _reason_not_blank(cls, v: str) -> str:
+        # min_length=1 放过纯空白(" "),trim 后再校验非空,避免审计/用户端记录到空理由
+        if not v.strip():
+            raise ValueError("拒绝理由不能为空")
+        return v.strip()
+
+
+class PriceReportSummary(BaseModel):
+    """审核台顶部各状态计数。"""
+
+    pending: int
+    approved: int
+    rejected: int
+    total: int

app/admin/schemas/user.py

@@ -0,0 +1,80 @@
+"""admin 用户管理 schemas。"""
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Literal
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator
+
+
+class AdminUserListItem(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    phone: str
+    nickname: str | None = None
+    register_channel: str
+    status: str
+    debug_trace_enabled: bool = False
+    wechat_openid: str | None = None
+    created_at: datetime
+    last_login_at: datetime
+
+
+class AdminUserOverview(BaseModel):
+    """用户 360 概览:基础资料 + 钱包余额 + 各项 count(历史明细走各自分页接口)。"""
+
+    model_config = ConfigDict(from_attributes=True)
+
+    user: AdminUserListItem
+    coin_balance: int
+    cash_balance_cents: int
+    total_coin_earned: int
+    comparison_total: int
+    comparison_success: int
+    withdraw_total: int
+    withdraw_success_cents: int
+    feedback_total: int
+
+
+def _strip_reason(v: str) -> str:
+    # min_length=1 放过纯空白(" "),trim 后再校验非空,避免审计记到空原因
+    if not v.strip():
+        raise ValueError("操作原因不能为空")
+    return v.strip()
+
+
+class GrantCoinsRequest(BaseModel):
+    mode: Literal["delta", "set"] = Field(
+        "delta", description="delta=增减(amount 为变动量) / set=设为(amount 为目标值,须≥0)"
+    )
+    amount: int = Field(
+        ...,
+        description="delta 模式:金币变动(正=增加,负=扣减,不可为 0);set 模式:目标金币值(须≥0)",
+    )
+    reason: str = Field(..., min_length=1, max_length=128, description="操作原因(必填,入审计)")
+
+    _v_reason = field_validator("reason")(_strip_reason)
+
+
+class GrantCashRequest(BaseModel):
+    mode: Literal["delta", "set"] = Field(
+        "delta", description="delta=增减(amount_cents 为变动量) / set=设为(amount_cents 为目标值,须≥0)"
+    )
+    amount_cents: int = Field(
+        ...,
+        description="delta 模式:现金变动(分,正=增加,负=扣减,不可为 0);set 模式:目标现金值(分,须≥0)",
+    )
+    reason: str = Field(..., min_length=1, max_length=128, description="操作原因(必填,入审计)")
+
+    _v_reason = field_validator("reason")(_strip_reason)
+
+
+class SetUserStatusRequest(BaseModel):
+    status: Literal["active", "disabled"] = Field(
+        ..., description="active=解封 / disabled=封禁(注销 deleted 不走此接口)"
+    )
+
+
+class SetDebugTraceRequest(BaseModel):
+    enabled: bool = Field(..., description="是否给该用户开「复制调试链接」权限")

app/admin/schemas/wallet.py

@@ -0,0 +1,149 @@
+"""admin 钱包(金币/现金流水 + 提现单)schemas。"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict, Field
+
+from app.admin.schemas.admin import AdminAuditLogOut
+
+
+class CoinTxnOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    user_id: int
+    amount: int
+    balance_after: int
+    biz_type: str
+    ref_id: str | None = None
+    remark: str | None = None
+    created_at: datetime
+
+
+class CashTxnOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    user_id: int
+    amount_cents: int
+    balance_after_cents: int
+    biz_type: str
+    ref_id: str | None = None
+    remark: str | None = None
+    created_at: datetime
+
+
+class WithdrawOrderOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    user_id: int
+    out_bill_no: str
+    amount_cents: int
+    user_name: str | None = None  # 提现实名(审核核对 + 打款用)
+    status: str
+    wechat_state: str | None = None
+    transfer_bill_no: str | None = None
+    fail_reason: str | None = None
+    created_at: datetime
+    updated_at: datetime
+
+
+class WithdrawSummaryOut(BaseModel):
+    reviewing_count: int
+    reviewing_amount_cents: int
+    pending_count: int
+    failed_count: int
+    today_success_count: int
+    today_success_amount_cents: int
+    today_rejected_count: int
+
+
+class WithdrawUserSnapshot(BaseModel):
+    id: int
+    phone: str
+    nickname: str | None = None
+    status: str
+    wechat_nickname: str | None = None
+    wechat_avatar_url: str | None = None
+    created_at: datetime
+    last_login_at: datetime
+    cash_balance_cents: int
+    withdraw_total: int
+    withdraw_success_cents: int
+
+
+class WithdrawDetailOut(BaseModel):
+    order: WithdrawOrderOut
+    user: WithdrawUserSnapshot | None = None
+    risk_flags: list[str]
+    risk_score: int
+    recent_withdraws: list[WithdrawOrderOut]
+    recent_cash_transactions: list[CashTxnOut]
+    audit_logs: list[AdminAuditLogOut]
+
+
+class ReconcileResult(BaseModel):
+    checked: int
+    resolved: int
+
+
+class WithdrawBulkRequest(BaseModel):
+    out_bill_nos: list[str] = Field(
+        ..., min_length=1, max_length=50, description="提现商户单号列表"
+    )
+
+
+class WithdrawBulkRejectRequest(WithdrawBulkRequest):
+    reason: str = Field(
+        ..., min_length=1, max_length=200, description="批量拒绝理由(用户可见)"
+    )
+
+
+class WithdrawBulkItemResult(BaseModel):
+    out_bill_no: str
+    ok: bool
+    status: str | None = None
+    error: str | None = None
+
+
+class WithdrawBulkResult(BaseModel):
+    total: int
+    success: int
+    failed: int
+    items: list[WithdrawBulkItemResult]
+
+
+class WithdrawLedgerCheckOut(BaseModel):
+    ok: bool
+    cash_balance_total_cents: int
+    cash_transaction_total_cents: int
+    balance_diff_cents: int
+    missing_withdraw_txn_count: int
+    missing_refund_txn_count: int
+    duplicate_refund_txn_count: int
+    refund_txn_on_non_terminal_count: int
+
+
+class WxpayHealthCheckOut(BaseModel):
+    ok: bool
+    wxpay_configured: bool
+    wxpay_auth_configured: bool
+    private_key_path: str
+    private_key_exists: bool
+    private_key_loadable: bool
+    public_key_path: str
+    public_key_exists: bool
+    public_key_loadable: bool
+    auth_notify_url_configured: bool
+    auto_reconcile_enabled: bool
+    auto_reconcile_interval_sec: int
+    auto_reconcile_older_than_minutes: int
+    issues: list[str]
+
+
+class WithdrawRejectRequest(BaseModel):
+    reason: str = Field(
+        ..., min_length=1, max_length=200, description="拒绝理由(写入 fail_reason,用户可见)"
+    )

app/admin/security.py

@@ -0,0 +1,55 @@
+"""Admin JWT:与 App 用户 token 完全隔离。
+
+用独立 secret(settings.ADMIN_JWT_SECRET ≠ JWT_SECRET_KEY)+ payload typ="admin",
+双重保证 App 用户的 access_token 无法当 admin token 用(secret 不同直接验签失败)。
+admin 无 refresh:过期(默认 12h)重新登录,简单。
+"""
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+import jwt
+
+from app.core.config import settings
+
+_ALGO = "HS256"
+
+
+class AdminTokenError(Exception):
+    """admin token 解析/校验失败,api 层捕获后返回 401。"""
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def create_admin_token(*, admin_id: int, role: str) -> tuple[str, int]:
+    """签发 admin access token,返回 (token, expires_in_seconds)。"""
+    now = _now()
+    expire = now + timedelta(minutes=settings.ADMIN_JWT_EXPIRE_MINUTES)
+    payload: dict[str, Any] = {
+        "sub": str(admin_id),
+        "role": role,
+        "typ": "admin",
+        "iat": int(now.timestamp()),
+        "exp": int(expire.timestamp()),
+    }
+    token = jwt.encode(payload, settings.ADMIN_JWT_SECRET, algorithm=_ALGO)
+    return token, int((expire - now).total_seconds())
+
+
+def decode_admin_token(token: str) -> dict[str, Any]:
+    """解析校验 admin token。签名错/过期/typ 非 admin → AdminTokenError。"""
+    try:
+        payload = jwt.decode(token, settings.ADMIN_JWT_SECRET, algorithms=[_ALGO])
+    except jwt.ExpiredSignatureError as e:
+        raise AdminTokenError("token expired") from e
+    except jwt.InvalidTokenError as e:
+        raise AdminTokenError(f"invalid token: {e}") from e
+
+    if payload.get("typ") != "admin":
+        raise AdminTokenError("not an admin token")
+    if "sub" not in payload:
+        raise AdminTokenError("token missing sub")
+    return payload

app/api/internal/__init__.py

@@ -0,0 +1 @@
+"""内部(server→server)端点。不对客户端开放,靠共享密钥头校验,不走用户 JWT。"""

app/api/internal/price.py

@@ -0,0 +1,63 @@
+"""价格观测内部上报端点(pricebot → app-server)。
+
+pricebot 在比价 done 帧把整批价格事实 POST 到这里落库。**不是给客户端的接口**:
+不走用户 JWT,靠 server 间共享密钥头 `X-Internal-Secret` 校验(== settings.INTERNAL_API_SECRET)。
+密钥未配置(默认空)时直接 503,避免裸奔的写端点。
+
+与不鉴权的比价透传(compare.py / coupon.py)无关:那两个是客户端→server 的透传壳,
+这个是 server→server 的内部写库。
+"""
+from __future__ import annotations
+
+import hmac
+import logging
+from typing import Annotated
+
+from fastapi import APIRouter, Header, HTTPException, status
+
+from app.api.deps import DbSession
+from app.core.config import settings
+from app.repositories import price_observation as repo
+from app.schemas.price_observation import (
+    PriceObservationBatchIn,
+    PriceObservationBatchOut,
+)
+
+logger = logging.getLogger("shagua.internal.price")
+
+router = APIRouter(prefix="/internal", tags=["internal"])
+
+
+def _check_secret(x_internal_secret: str | None) -> None:
+    """共享密钥校验。未配置 → 503(挡住裸奔写端点);不匹配 → 401(常量时间比较)。"""
+    configured = settings.INTERNAL_API_SECRET
+    if not configured:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="internal api not configured",
+        )
+    if not x_internal_secret or not hmac.compare_digest(x_internal_secret, configured):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="invalid internal secret",
+        )
+
+
+@router.post(
+    "/price-observation",
+    response_model=PriceObservationBatchOut,
+    summary="价格观测内部上报(pricebot→app-server,落 price_observation)",
+)
+def report_price_observation(
+    payload: PriceObservationBatchIn,
+    db: DbSession,
+    x_internal_secret: Annotated[str | None, Header()] = None,
+) -> PriceObservationBatchOut:
+    _check_secret(x_internal_secret)
+    inserted, skipped = repo.insert_batch(db, payload)
+    logger.info(
+        "price_observation trace=%s inserted=%d skipped=%d device=%s user=%s",
+        payload.trace_id, inserted, skipped,
+        payload.source_device_id, payload.source_user_id,
+    )
+    return PriceObservationBatchOut(inserted=inserted, skipped=skipped)

app/api/internal/store.py

@@ -0,0 +1,79 @@
+"""平台店铺映射内部上报端点(pricebot → app-server)。
+
+pricebot 在淘宝比价拿到 shopId 后,把这一行跨平台店铺映射 POST 到这里落库。
+**不是给客户端的接口**:不走用户 JWT,靠 server 间共享密钥头 `X-Internal-Secret` 校验
+(复用 price.py 的 _check_secret,与 price-observation 同一密钥)。
+
+与 price.py 的 /internal/price-observation 平行:那个落价格事实,这个落店铺身份映射。
+"""
+from __future__ import annotations
+
+import logging
+
+from typing import Annotated
+
+from fastapi import APIRouter, Header
+
+from app.api.deps import DbSession
+from app.api.internal.price import _check_secret
+from app.repositories import store_mapping as repo
+from app.schemas.store_mapping import StoreMappingIn, StoreMappingOut
+
+logger = logging.getLogger("shagua.internal.store")
+
+router = APIRouter(prefix="/internal", tags=["internal"])
+
+
+@router.get(
+    "/store-mapping/lookup",
+    summary="比价前按源平台店名反查各目标平台已沉淀的店铺 id(命中→pricebot 直接 deeplink)",
+)
+def lookup_store_mapping(
+    source_platform: str,
+    name: str,
+    db: DbSession,
+    lat: float | None = None,
+    lng: float | None = None,
+    x_internal_secret: Annotated[str | None, Header()] = None,
+) -> dict:
+    _check_secret(x_internal_secret)
+    result = repo.lookup_nearest(db, source_platform, name, lat, lng)
+    if result:
+        hits = ", ".join(
+            f"{t}:row{v['row_id']}"
+            f"{'(' + str(v['dist_km']) + 'km)' if 'dist_km' in v else ''}"
+            f"→{v.get('deeplink') or '(无deeplink)'}"
+            for t, v in result.items()
+        )
+        logger.info(
+            "store_mapping lookup source=%s name=%r geo=(%s,%s) → 命中 %s",
+            source_platform, name, lat, lng, hits,
+        )
+    else:
+        logger.info(
+            "store_mapping lookup source=%s name=%r geo=(%s,%s) → MISS",
+            source_platform, name, lat, lng,
+        )
+    return result
+
+
+@router.post(
+    "/store-mapping",
+    response_model=StoreMappingOut,
+    summary="平台店铺映射内部上报(pricebot→app-server,落 store_mapping)",
+)
+def report_store_mapping(
+    payload: StoreMappingIn,
+    db: DbSession,
+    x_internal_secret: Annotated[str | None, Header()] = None,
+) -> StoreMappingOut:
+    _check_secret(x_internal_secret)
+    created, row_id = repo.upsert(db, payload)
+    logger.info(
+        "store_mapping trace=%s %s row_id=%s source=%s "
+        "taobao=(%s,%s) jd=(%s,%s) device=%s user=%s",
+        payload.trace_id, "新建" if created else "合并", row_id, payload.source_platform,
+        payload.id_taobao, payload.name_taobao, payload.id_jd, payload.name_jd,
+        payload.source_device_id, payload.source_user_id,
+    )
+    return StoreMappingOut(inserted=created, row_id=row_id)

app/api/v1/ad.py

@@ -10,6 +10,7 @@
 from __future__ import annotations
 
 import logging
+import json
 import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, Request, status
@@ -19,8 +20,23 @@ from app.core import rewards
 from app.core.config import settings
 from app.integrations import pangle
 from app.core.ratelimit import rate_limit
+from app.repositories import ad_ecpm as crud_ecpm
+from app.repositories import ad_feed_reward as crud_feed
 from app.repositories import ad_reward as crud_ad
-from app.schemas.ad import AdRewardStatusOut, PangleCallbackOut, TestGrantOut
+from app.repositories import ad_watch as crud_watch
+from app.repositories import signin as crud_signin
+from app.schemas.ad import (
+    AdRewardStatusOut,
+    EcpmReportIn,
+    EcpmReportOut,
+    FeedRewardIn,
+    FeedRewardOut,
+    PangleCallbackOut,
+    TestGrantIn,
+    TestGrantOut,
+    WatchReportIn,
+    WatchReportOut,
+)
 
 logger = logging.getLogger("shagua.ad")
 
@@ -31,6 +47,23 @@ REASON_OK = 0
 REASON_BAD_PARAMS = 1  # 验签过但缺 trans_id / user_id 非数字
 REASON_UNKNOWN_USER = 2  # user_id 不存在(可能伪造)
 
+REWARD_SCENE_REWARD_VIDEO = "reward_video"
+REWARD_SCENE_SIGNIN_BOOST = "signin_boost"
+SUPPORTED_REWARD_SCENES = {REWARD_SCENE_REWARD_VIDEO, REWARD_SCENE_SIGNIN_BOOST}
+
+
+def _parse_extra(raw_extra: str | None) -> dict[str, str]:
+    """解析客户端 setMediaExtra 透传的 JSON;旧格式/异常返回空 dict。"""
+    if not raw_extra:
+        return {}
+    try:
+        data = json.loads(raw_extra)
+    except (TypeError, ValueError):
+        return {}
+    if not isinstance(data, dict):
+        return {}
+    return {str(k): str(v) for k, v in data.items() if v is not None}
+
 
 @router.get(
     "/pangle-callback",
@@ -39,9 +72,9 @@ REASON_UNKNOWN_USER = 2  # user_id 不存在(可能伪造)
     dependencies=[Depends(rate_limit(300, 60, "pangle-callback"))],
 )
 def pangle_callback(request: Request, db: DbSession) -> PangleCallbackOut:
-    """穿山甲 GroMore 在激励视频播完后回调,带 user_id / trans_id / reward_amount / sign 等 query 参数。
+    """穿山甲 GroMore 在激励视频播完后回调,带 user_id / trans_id / ecpm / sign 等 query 参数。
 
-    流程:开关/密钥就绪 → 验签(SHA256(m-key:trans_id)) → 解析 user_id/reward_amount → 幂等发金币。
+    流程:开关/密钥就绪 → 验签(SHA256(m-key:trans_id)) → 解析 user_id/场景/eCPM → 幂等发金币。
     验签失败 403(留给真请求重试);参数缺/坏或 user 不存在 → is_verify=false + reason(不发,不重试)。
     granted / capped → is_verify=true + reason=0。
     """
@@ -64,19 +97,86 @@ def pangle_callback(request: Request, db: DbSession) -> PangleCallbackOut:
         return PangleCallbackOut(is_verify=False, reason=REASON_BAD_PARAMS)
 
     user_id = int(raw_user_id)
-    coin = rewards.resolve_ad_reward_coin(params.get("reward_amount"))
     raw = "&".join(f"{k}={v}" for k, v in sorted(params.items()) if k != "sign")
-    try:
-        rec = crud_ad.grant_ad_reward(
-            db, user_id, trans_id, coin=coin,
-            reward_name=params.get("reward_name"), raw=raw[:1024],
+    extra = {}
+    for extra_key in ("extra", "gromoreExtra", "gromore_extra"):
+        extra.update(_parse_extra(params.get(extra_key)))
+    reward_scene = extra.get("reward_scene") or REWARD_SCENE_REWARD_VIDEO
+    ad_session_id = extra.get("ad_session_id")
+    ecpm = params.get("ecpm")
+
+    existing = crud_ad.find_by_trans(db, trans_id)
+    if existing is not None:
+        logger.info(
+            "pangle callback idempotent user_id=%d trans_id=%s status=%s scene=%s",
+            user_id, trans_id, existing.status, existing.reward_scene,
         )
+        return PangleCallbackOut(is_verify=True, reason=REASON_OK)
+
+    try:
+        if reward_scene not in SUPPORTED_REWARD_SCENES:
+            rec = crud_ad.record_external_reward(
+                db, user_id, trans_id, coin=0, reward_scene=reward_scene[:32],
+                ad_session_id=ad_session_id, ecpm=ecpm,
+                reward_name=params.get("reward_name"), raw=raw[:1024],
+                status="unknown_scene",
+            )
+            logger.warning(
+                "pangle callback unknown scene user_id=%d trans_id=%s scene=%s",
+                user_id, trans_id, reward_scene,
+            )
+            return PangleCallbackOut(is_verify=False, reason=REASON_BAD_PARAMS)
+        if reward_scene == REWARD_SCENE_SIGNIN_BOOST:
+            try:
+                boost, _balance = crud_signin.boost_today_signin(
+                    db, user_id, ad_ref_id=trans_id, commit=False
+                )
+            except crud_signin.NotSignedTodayError:
+                db.rollback()
+                rec = crud_ad.record_external_reward(
+                    db, user_id, trans_id, coin=0, reward_scene=reward_scene,
+                    ad_session_id=ad_session_id, ecpm=ecpm,
+                    reward_name=params.get("reward_name"), raw=raw[:1024],
+                    status="not_signed",
+                )
+            except crud_signin.AlreadyBoostedError:
+                db.rollback()
+                rec = crud_ad.record_external_reward(
+                    db, user_id, trans_id, coin=0, reward_scene=reward_scene,
+                    ad_session_id=ad_session_id, ecpm=ecpm,
+                    reward_name=params.get("reward_name"), raw=raw[:1024],
+                    status="already_boosted",
+                )
+            except crud_signin.LastCycleDayBoostBlockedError:
+                db.rollback()
+                rec = crud_ad.record_external_reward(
+                    db, user_id, trans_id, coin=0, reward_scene=reward_scene,
+                    ad_session_id=ad_session_id, ecpm=ecpm,
+                    reward_name=params.get("reward_name"), raw=raw[:1024],
+                    status="last_day",
+                )
+            else:
+                rec = crud_ad.record_external_reward(
+                    db, user_id, trans_id, coin=boost.coin_awarded,
+                    reward_scene=reward_scene, ad_session_id=ad_session_id, ecpm=ecpm,
+                    reward_name=params.get("reward_name"), raw=raw[:1024],
+                    commit=False,
+                )
+                db.commit()
+                db.refresh(rec)
+        else:
+            rec = crud_ad.grant_ad_reward(
+                db, user_id, trans_id, ecpm=ecpm, ad_session_id=ad_session_id,
+                reward_scene=REWARD_SCENE_REWARD_VIDEO,
+                reward_name=params.get("reward_name"), raw=raw[:1024],
+            )
     except crud_ad.UnknownUserError:
         logger.warning("pangle callback unknown user_id=%d trans_id=%s", user_id, trans_id)
         return PangleCallbackOut(is_verify=False, reason=REASON_UNKNOWN_USER)
 
     logger.info(
-        "ad reward user_id=%d trans_id=%s status=%s coin=%d", user_id, trans_id, rec.status, rec.coin
+        "ad reward user_id=%d trans_id=%s scene=%s status=%s coin=%d",
+        user_id, trans_id, rec.reward_scene, rec.status, rec.coin,
     )
     # granted / capped 均算"已处理":is_verify=true 不让穿山甲重试(capped 只是没加币)
     return PangleCallbackOut(is_verify=True, reason=REASON_OK)
@@ -84,22 +184,79 @@ def pangle_callback(request: Request, db: DbSession) -> PangleCallbackOut:
 
 @router.get("/reward-status", response_model=AdRewardStatusOut, summary="今日看广告发奖进度")
 def reward_status(user: CurrentUser, db: DbSession) -> AdRewardStatusOut:
-    used, limit, coin_per = crud_ad.today_status(db, user.id)
+    (used, limit, coin_per, round_count, cooldown_until,
+     watched_sec, watch_limit) = crud_ad.today_status(db, user.id)
     return AdRewardStatusOut(
         used_today=used,
         daily_limit=limit,
         remaining=max(0, limit - used),
         coin_per_ad=coin_per,
+        round_count=round_count,
+        cooldown_until=cooldown_until,
+        watched_seconds_today=watched_sec,
+        watch_seconds_limit=watch_limit,
+        watch_seconds_remaining=max(0, watch_limit - watched_sec),
     )
 
 
+@router.post(
+    "/watch-report",
+    response_model=WatchReportOut,
+    summary="上报激励视频观看时长(旧客户端兼容字段)",
+    dependencies=[Depends(rate_limit(120, 60, "ad-watch-report"))],
+)
+def watch_report(payload: WatchReportIn, user: CurrentUser, db: DbSession) -> WatchReportOut:
+    """客户端在激励视频关闭(onAdClose)后上报本次实际观看秒数,服务端累计到当日总时长。
+
+    Bearer 鉴权,user_id 取自 JWT(不信 body)。seconds 服务端夹 [0, MAX_SINGLE_WATCH_SECONDS]。
+    当前产品只保留每日 500 次上限,DAILY_AD_WATCH_SECONDS_LIMIT=0 表示时长闸不启用;该接口
+    仍保留用于旧客户端兼容和排查观看时长。
+    """
+    total = crud_watch.add_watch_seconds(db, user.id, payload.seconds)
+    limit = rewards.DAILY_AD_WATCH_SECONDS_LIMIT
+    logger.info(
+        "ad watch report user_id=%d +%ds total=%d/%d",
+        user.id, payload.seconds, total, limit,
+    )
+    return WatchReportOut(
+        watched_seconds_today=total,
+        watch_seconds_limit=limit,
+        watch_seconds_remaining=max(0, limit - total),
+    )
+
+
+@router.post(
+    "/ecpm-report",
+    response_model=EcpmReportOut,
+    summary="上报本次广告展示的 eCPM(内部收益统计)",
+    dependencies=[Depends(rate_limit(120, 60, "ad-ecpm-report"))],
+)
+def ecpm_report(payload: EcpmReportIn, user: CurrentUser, db: DbSession) -> EcpmReportOut:
+    """客户端在广告展示后(onAdShow 读 getShowEcpm)上报 eCPM,落库做内部收益统计/对账。
+
+    Bearer 鉴权,user_id 取自 JWT(不信 body)。best-effort:落库即 ok,客户端 fire-and-forget,
+    丢一两条不影响业务(穿山甲后台报表是结算权威)。eCPM 与发奖(S2S)是两条独立流,不逐条关联。
+    """
+    crud_ecpm.create_ecpm_record(
+        db, user.id,
+        ad_type=payload.ad_type, ecpm_raw=payload.ecpm,
+        ad_session_id=payload.ad_session_id,
+        adn=payload.adn, slot_id=payload.slot_id,
+    )
+    logger.info(
+        "ad ecpm report user_id=%d type=%s session=%s ecpm=%s adn=%s slot=%s",
+        user.id, payload.ad_type, payload.ad_session_id, payload.ecpm, payload.adn, payload.slot_id,
+    )
+    return EcpmReportOut(ok=True)
+
+
 @router.post(
     "/test-grant",
     response_model=TestGrantOut,
     summary="[仅本地联调]模拟穿山甲回调发奖",
     dependencies=[Depends(rate_limit(60, 60, "ad-test-grant"))],
 )
-def test_grant(user: CurrentUser, db: DbSession) -> TestGrantOut:
+def test_grant(user: CurrentUser, db: DbSession, payload: TestGrantIn | None = None) -> TestGrantOut:
     """⚠️ 仅本地联调用:没部署公网、穿山甲 S2S 回调打不到本地时,客户端(debug 包)看完广告后
     调这个接口,直接走与回调相同的发奖逻辑(幂等 + 每日上限),验证"看广告→金币到账"全链路。
 
@@ -109,17 +266,66 @@ def test_grant(user: CurrentUser, db: DbSession) -> TestGrantOut:
     if not settings.AD_REWARD_TEST_GRANT_ENABLED:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="not found")
 
-    # 每次新 trans_id,模拟一次独立的穿山甲发奖回调(幂等键各不相同 → 每次都发,直到当日上限)
-    trans_id = f"test-{user.id}-{uuid.uuid4().hex}"
-    try:
-        rec = crud_ad.grant_ad_reward(
-            db, user.id, trans_id, reward_name="测试发奖", raw="client debug test-grant"
-        )
-    except crud_ad.UnknownUserError as e:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="user not found") from e
+    reward_scene = (payload.reward_scene if payload is not None else REWARD_SCENE_REWARD_VIDEO)
+    if reward_scene not in SUPPORTED_REWARD_SCENES:
+        raise HTTPException(status_code=status.HTTP_422_UNPROCESSABLE_ENTITY, detail="bad reward_scene")
 
-    used, limit, coin_per = crud_ad.today_status(db, user.id)
-    logger.info("ad TEST grant user_id=%d status=%s coin=%d", user.id, rec.status, rec.coin)
+    # 每次新 trans_id,模拟一次独立的穿山甲发奖回调(幂等键各不相同 → 每次都发,直到当日上限/今日膨胀一次)
+    trans_id = f"test-{user.id}-{uuid.uuid4().hex}"
+    if reward_scene == REWARD_SCENE_SIGNIN_BOOST:
+        try:
+            boost, _balance = crud_signin.boost_today_signin(
+                db, user.id, ad_ref_id=trans_id, commit=False
+            )
+        except crud_signin.NotSignedTodayError:
+            db.rollback()
+            rec = crud_ad.record_external_reward(
+                db, user.id, trans_id, coin=0, reward_scene=reward_scene,
+                raw="client debug test-grant signin_boost", status="not_signed",
+            )
+        except crud_signin.AlreadyBoostedError:
+            db.rollback()
+            rec = crud_ad.record_external_reward(
+                db, user.id, trans_id, coin=0, reward_scene=reward_scene,
+                raw="client debug test-grant signin_boost", status="already_boosted",
+            )
+        except crud_signin.LastCycleDayBoostBlockedError:
+            db.rollback()
+            rec = crud_ad.record_external_reward(
+                db, user.id, trans_id, coin=0, reward_scene=reward_scene,
+                raw="client debug test-grant signin_boost", status="last_day",
+            )
+        else:
+            rec = crud_ad.record_external_reward(
+                db, user.id, trans_id, coin=boost.coin_awarded,
+                reward_scene=reward_scene, reward_name="测试签到膨胀",
+                raw="client debug test-grant signin_boost", commit=False,
+            )
+            db.commit()
+            db.refresh(rec)
+    else:
+        # 优先用客户端按 ad_session_id 上报的真实 eCPM(走与正式发奖相同的公式);
+        # 取不到或 eCPM≤0(测试应用常返 0/假值)时兜底 200,保证本地联调仍能验出非零金币。
+        ad_session_id = payload.ad_session_id if payload is not None else None
+        ecpm_val = "200"
+        if ad_session_id:
+            ecpm_rec = crud_ecpm.find_by_session(db, user_id=user.id, ad_session_id=ad_session_id)
+            if ecpm_rec is not None and rewards.parse_ecpm_fen(ecpm_rec.ecpm_raw) > 0:
+                ecpm_val = ecpm_rec.ecpm_raw
+        try:
+            rec = crud_ad.grant_ad_reward(
+                db, user.id, trans_id, ecpm=ecpm_val, ad_session_id=ad_session_id,
+                reward_name="测试发奖", raw=f"client debug test-grant ecpm={ecpm_val}",
+            )
+        except crud_ad.UnknownUserError as e:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="user not found") from e
+
+    (used, limit, coin_per, round_count, cooldown_until,
+     _watched, _watch_limit) = crud_ad.today_status(db, user.id)
+    logger.info(
+        "ad TEST grant user_id=%d scene=%s status=%s coin=%d",
+        user.id, reward_scene, rec.status, rec.coin,
+    )
     return TestGrantOut(
         granted=(rec.status == "granted"),
         status=rec.status,
@@ -128,4 +334,40 @@ def test_grant(user: CurrentUser, db: DbSession) -> TestGrantOut:
         daily_limit=limit,
         remaining=max(0, limit - used),
         coin_per_ad=coin_per,
+        round_count=round_count,
+        cooldown_until=cooldown_until,
+    )
+
+
+@router.post(
+    "/feed-reward",
+    response_model=FeedRewardOut,
+    summary="信息流广告完成后结算金币",
+    dependencies=[Depends(rate_limit(120, 60, "ad-feed-reward"))],
+)
+def feed_reward(payload: FeedRewardIn, user: CurrentUser, db: DbSession) -> FeedRewardOut:
+    """点位 2:信息流广告每展示满 10 秒累计一份奖励,视频完成后一次性入账。
+
+    当前一期由客户端完成回调携带 eCPM / 展示秒数上报;client_event_id 做幂等键,避免重试重复发。
+    """
+    rec = crud_feed.grant_feed_reward(
+        db,
+        user.id,
+        client_event_id=payload.client_event_id,
+        ecpm=payload.ecpm,
+        duration_seconds=payload.duration_seconds,
+        ad_session_id=payload.ad_session_id,
+        adn=payload.adn,
+        slot_id=payload.slot_id,
+    )
+    logger.info(
+        "feed ad reward user_id=%d event=%s status=%s units=%d coin=%d",
+        user.id, rec.client_event_id, rec.status, rec.unit_count, rec.coin,
+    )
+    return FeedRewardOut(
+        granted=(rec.status == "granted"),
+        status=rec.status,
+        coin=rec.coin,
+        unit_count=rec.unit_count,
+        daily_limit=rewards.get_ad_daily_limit(db),
     )

app/api/v1/auth.py

@@ -12,12 +12,14 @@ from __future__ import annotations
 
 import logging
 
-from fastapi import APIRouter, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, status
 
 from app.api.deps import CurrentUser, DbSession
+from app.core.ratelimit import rate_limit
 from app.core.security import TokenError, decode_token, issue_token_pair
 from app.integrations.jiguang import JiguangError, mask_phone, verify_and_get_phone
 from app.integrations.sms import SmsError, send_code, verify_code
+from app.repositories import onboarding as onboarding_repo
 from app.repositories import user as user_repo
 from app.schemas.auth import (
     JverifyLoginRequest,
@@ -36,12 +38,13 @@ logger = logging.getLogger("shagua.auth")
 router = APIRouter(prefix="/api/v1/auth", tags=["auth"])
 
 
-def _login_response(db, user) -> TokenWithUser:
-    """登录类接口共用的响应组装。"""
+def _login_response(user, *, onboarding_completed: bool) -> TokenWithUser:
+    """登录类接口共用的响应组装。onboarding_completed 据登录请求的 device_id 算好后传入。"""
     tokens = issue_token_pair(user.id)
     return TokenWithUser(
         **tokens,
         user=UserOut.model_validate(user),
+        onboarding_completed=onboarding_completed,
     )
 
 
@@ -65,25 +68,36 @@ def jverify_login(req: JverifyLoginRequest, db: DbSession) -> TokenWithUser:
     if user.status != "active":
         raise HTTPException(status_code=403, detail="account disabled")
 
-    logger.info("jverify_login ok user_id=%d phone=%s", user.id, mask_phone(phone))
-    return _login_response(db, user)
+    completed = onboarding_repo.is_completed(db, user_id=user.id, device_id=req.device_id)
+    logger.info("jverify_login ok user_id=%d phone=%s onboarded=%s", user.id, mask_phone(phone), completed)
+    return _login_response(user, onboarding_completed=completed)
 
 
 # ===================== 短信登录 =====================
 
-@router.post("/sms/send", response_model=SmsSendResponse, summary="发送短信验证码 (mock)")
+@router.post(
+    "/sms/send",
+    response_model=SmsSendResponse,
+    summary="发送短信验证码",
+    dependencies=[Depends(rate_limit(10, 60, "sms-send"))],  # 同 IP 每分钟≤10 次(防一 IP 刷不同号)
+)
 def sms_send(req: SmsSendRequest) -> SmsSendResponse:
     try:
         cooldown = send_code(req.phone)
     except SmsError as e:
-        raise HTTPException(status_code=429, detail=str(e)) from e
+        raise HTTPException(status_code=e.status_code, detail=str(e)) from e
 
     from app.core.config import settings  # 局部 import 避免循环
 
     return SmsSendResponse(sent=True, mock=settings.SMS_MOCK, cooldown_sec=cooldown)
 
 
-@router.post("/sms/login", response_model=TokenWithUser, summary="手机号+验证码登录")
+@router.post(
+    "/sms/login",
+    response_model=TokenWithUser,
+    summary="手机号+验证码登录",
+    dependencies=[Depends(rate_limit(20, 60, "sms-login"))],  # 防撞库爆破(另有单码失败次数上限)
+)
 def sms_login(req: SmsLoginRequest, db: DbSession) -> TokenWithUser:
     if not verify_code(req.phone, req.code):
         raise HTTPException(status_code=400, detail="invalid sms code")
@@ -92,8 +106,9 @@ def sms_login(req: SmsLoginRequest, db: DbSession) -> TokenWithUser:
     if user.status != "active":
         raise HTTPException(status_code=403, detail="account disabled")
 
-    logger.info("sms_login ok user_id=%d phone=%s", user.id, mask_phone(req.phone))
-    return _login_response(db, user)
+    completed = onboarding_repo.is_completed(db, user_id=user.id, device_id=req.device_id)
+    logger.info("sms_login ok user_id=%d phone=%s onboarded=%s", user.id, mask_phone(req.phone), completed)
+    return _login_response(user, onboarding_completed=completed)
 
 
 # ===================== Refresh =====================

app/api/v1/compare.py

@@ -18,6 +18,7 @@ pricebot 协议文档:
 """
 from __future__ import annotations
 
+import json
 import logging
 from typing import Any
 
@@ -25,6 +26,7 @@ import httpx
 from fastapi import APIRouter, HTTPException, Request, status
 
 from app.core.config import settings
+from app.core.pricebot_router import pick_pricebot
 
 logger = logging.getLogger("shagua.compare")
 
@@ -38,25 +40,35 @@ async def _passthrough(request: Request, upstream_path: str) -> dict[str, Any]:
     打日志。比价单帧是大上下文 / 逐帧 LLM,超时用 PRICEBOT_COMPARE_TIMEOUT_SEC(60s,
     比领券的 30s 长)。
     """
+    # 读原始字节,避免"反序列化→再序列化"的双重 JSON(省 ~一半透传 CPU,让 app-server
+    # 单 worker 也扛得住高并发)。只 json.loads 一次拿 trace_id 做亲和 + 打日志,转发时
+    # 直接发原始 bytes(content=raw),不重新 dumps。
+    raw = await request.body()
     try:
-        body = await request.json()
+        meta = json.loads(raw)
     except Exception as e:
         raise HTTPException(status_code=400, detail=f"invalid json body: {e}") from e
+    if not isinstance(meta, dict):
+        meta = {}
 
-    url = f"{settings.PRICEBOT_BASE_URL.rstrip('/')}{upstream_path}"
+    # 按 trace_id 一致性 hash 选 pricebot 实例(同一比价的所有帧落同一进程,内存维护 state)
+    base = pick_pricebot(meta.get("trace_id"))
+    url = f"{base.rstrip('/')}{upstream_path}"
     timeout = settings.PRICEBOT_COMPARE_TIMEOUT_SEC
 
     logger.info(
         "compare %s device_id=%s trace_id=%s step=%s",
         upstream_path,
-        body.get("device_id"),
-        body.get("trace_id"),
-        body.get("step"),
+        meta.get("device_id"),
+        meta.get("trace_id"),
+        meta.get("step"),
     )
 
     try:
         async with httpx.AsyncClient(timeout=timeout) as client:
-            resp = await client.post(url, json=body)
+            resp = await client.post(
+                url, content=raw, headers={"Content-Type": "application/json"}
+            )
     except httpx.RequestError as e:
         logger.error("[pricebot] request failed: %s", e)
         raise HTTPException(
@@ -83,6 +95,24 @@ async def intent_recognize(request: Request) -> dict[str, Any]:
     return await _passthrough(request, "/api/intent/recognize")
 
 
+@router.post("/intent/step", summary="外卖比价 Phase 1 多帧意图识别 (透传到 pricebot, 仅淘宝源)")
+async def intent_step(request: Request) -> dict[str, Any]:
+    # 多帧版意图识别(展开+滚动采集→提取): 循环调用直到 done(done 帧顶层带
+    # result+calibration)。目前仅淘宝源走这条, 其它源走上面单次 /intent/recognize。
+    return await _passthrough(request, "/api/intent/step")
+
+
+@router.post(
+    "/intent/precoupon/step",
+    summary="外卖比价 Phase 0 意图识别前先用券 (透传到 pricebot, 仅美团源)",
+)
+async def intent_precoupon_step(request: Request) -> dict[str, Any]:
+    # 美团源平台『意图识别前先用券』多帧循环: 客户端在调 /intent/recognize 之前先循环
+    # 调本端点到 done(continue=false)。订单页底部有『点击使用X红包』就自动选最大免费券
+    # 用上, 已用券/无券则首帧秒过。与 /intent/step 同属 intent 域, 复用同一透传壳。
+    return await _passthrough(request, "/api/intent/precoupon/step")
+
+
 @router.post("/price/step", summary="外卖比价 Phase 2 步进 (透传到 pricebot)")
 async def price_step(request: Request) -> dict[str, Any]:
     return await _passthrough(request, "/api/price/step")

app/api/v1/compare_milestone.py

@@ -0,0 +1,76 @@
+"""比价战绩里程碑 endpoint(福利页「记录比价战绩」)。
+
+路由前缀 `/api/v1/compare`:
+  GET  /milestones                进度与各档领取状态
+  POST /milestones/{milestone}/claim  领取某档奖励
+
+**均需鉴权**。解锁进度 = 该用户 status='success' 的 comparison_record 条数;每档领一次。
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, HTTPException, status
+
+from app.api.deps import CurrentUser, DbSession
+from app.repositories import comparison_milestone as crud_milestone
+from app.schemas.compare_record import (
+    MilestoneClaimResultOut,
+    MilestoneStateOut,
+    MilestoneStatusOut,
+)
+
+logger = logging.getLogger("shagua.compare_milestone")
+
+router = APIRouter(prefix="/api/v1/compare", tags=["compare-milestone"])
+
+
+@router.get(
+    "/milestones",
+    response_model=MilestoneStatusOut,
+    summary="比价战绩里程碑进度",
+)
+def get_milestones(user: CurrentUser, db: DbSession) -> MilestoneStatusOut:
+    st = crud_milestone.get_status(db, user.id)
+    return MilestoneStatusOut(
+        success_count=st.success_count,
+        claimable_count=st.claimable_count,
+        milestones=[
+            MilestoneStateOut(milestone=m.milestone, coin=m.coin, state=m.state)
+            for m in st.milestones
+        ],
+    )
+
+
+@router.post(
+    "/milestones/{milestone}/claim",
+    response_model=MilestoneClaimResultOut,
+    summary="领取比价战绩里程碑奖励",
+)
+def claim_milestone(
+    milestone: int, user: CurrentUser, db: DbSession
+) -> MilestoneClaimResultOut:
+    try:
+        coin, balance = crud_milestone.claim(db, user.id, milestone)
+    except crud_milestone.UnknownMilestoneError as e:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="unknown milestone"
+        ) from e
+    except crud_milestone.MilestoneLockedError as e:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="milestone locked"
+        ) from e
+    except crud_milestone.AlreadyClaimedError as e:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="milestone already claimed"
+        ) from e
+
+    logger.info(
+        "compare milestone claimed user_id=%d milestone=%d coin=%d",
+        user.id,
+        milestone,
+        coin,
+    )
+    return MilestoneClaimResultOut(
+        milestone=milestone, coin_awarded=coin, coin_balance=balance
+    )

app/api/v1/compare_record.py

@@ -0,0 +1,107 @@
+"""比价记录 endpoint(「我的比价记录」数据源)。
+
+路由前缀 `/api/v1/compare`:
+  POST /record         上报一次比价结果(幂等:同 user+trace_id 覆盖)
+  GET  /records        比价记录列表(游标分页)
+  GET  /records/{id}   单条详情(含 raw_payload 全量)
+
+**均需鉴权**(CurrentUser)——与同文件无关的不鉴权透传 `compare.py` 分开:那个是
+转发壳(MVP 不鉴权),这里是按用户维度落库的业务接口,必须有 user_id。
+
+注:本轮只做 server 端,客户端(android 仓)在 done 帧后调 POST /record 上报的改动
+另起一轮(见 app-server docs/待办与技术债.md P1)。
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, HTTPException, Query, status
+
+from app.api.deps import CurrentUser, DbSession
+from app.repositories import comparison as crud_compare
+from app.schemas.compare_record import (
+    CompareStatsOut,
+    ComparisonRecordCreatedOut,
+    ComparisonRecordDetailOut,
+    ComparisonRecordIn,
+    ComparisonRecordPage,
+    ComparisonRecordOut,
+)
+
+logger = logging.getLogger("shagua.compare_record")
+
+router = APIRouter(prefix="/api/v1/compare", tags=["compare-record"])
+
+
+@router.post(
+    "/record",
+    response_model=ComparisonRecordCreatedOut,
+    summary="上报一次比价结果(幂等)",
+)
+def report_record(
+    payload: ComparisonRecordIn, user: CurrentUser, db: DbSession
+) -> ComparisonRecordCreatedOut:
+    rec = crud_compare.upsert_record(db, user_id=user.id, payload=payload)
+    logger.info(
+        "compare record user=%s trace=%s biz=%s status=%s saved=%s",
+        user.id,
+        rec.trace_id,
+        rec.business_type,
+        rec.status,
+        rec.saved_amount_cents,
+    )
+    return ComparisonRecordCreatedOut(id=rec.id)
+
+
+@router.get(
+    "/stats",
+    response_model=CompareStatsOut,
+    summary="比价口径战绩(完成比价数 + 累计发现可省)",
+)
+def stats(user: CurrentUser, db: DbSession) -> CompareStatsOut:
+    count, saved = crud_compare.get_stats(db, user.id)
+    return CompareStatsOut(compare_count=count, discovered_saved_cents=saved)
+
+
+@router.get(
+    "/records",
+    response_model=ComparisonRecordPage,
+    summary="比价记录列表(游标分页)",
+)
+def list_records(
+    user: CurrentUser,
+    db: DbSession,
+    limit: int = Query(20, ge=1, le=100),
+    cursor: int | None = Query(None, description="上一页末条 id"),
+) -> ComparisonRecordPage:
+    items, next_cursor = crud_compare.list_records(
+        db, user.id, limit=limit, cursor=cursor
+    )
+    outs = [ComparisonRecordOut.model_validate(it) for it in items]
+    # 权限闸:未开 debug_trace_enabled 的用户不下发 trace_url(列表页「复制调试链接」靠它)
+    if not user.debug_trace_enabled:
+        for o in outs:
+            o.trace_url = None
+    return ComparisonRecordPage(items=outs, next_cursor=next_cursor)
+
+
+@router.get(
+    "/records/{record_id}",
+    response_model=ComparisonRecordDetailOut,
+    summary="比价记录详情(含 raw_payload)",
+)
+def get_record(
+    record_id: int, user: CurrentUser, db: DbSession
+) -> ComparisonRecordDetailOut:
+    rec = crud_compare.get_record(db, user.id, record_id)
+    if rec is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="record not found")
+    out = ComparisonRecordDetailOut.model_validate(rec)
+    # 权限闸:未开 debug_trace_enabled 的用户不下发 trace_url。
+    # ⚠️ raw_payload 是上报体全量(model_dump),里面也藏着一份 trace_url,必须一并抹掉——
+    # 否则无权限用户从详情接口的 raw_payload 绕过权限闸拿到 trace_url。
+    if not user.debug_trace_enabled:
+        out.trace_url = None
+        if isinstance(out.raw_payload, dict):
+            out.raw_payload.pop("trace_url", None)
+    return out

app/api/v1/coupon.py

@@ -10,19 +10,84 @@ pricebot 协议文档:
 """
 from __future__ import annotations
 
+import json
 import logging
 from typing import Any
 
 import httpx
 from fastapi import APIRouter, HTTPException, Request, status
+from fastapi.concurrency import run_in_threadpool
 
+from app.api.deps import DbSession
 from app.core.config import settings
+from app.core.pricebot_router import pick_pricebot
+from app.db.session import SessionLocal
+from app.repositories import coupon_state as coupon_repo
+from app.schemas.coupon_state import (
+    CouponCompletedTodayOut,
+    CouponPromptDismissIn,
+    CouponPromptShouldShowOut,
+)
 
 logger = logging.getLogger("shagua.coupon")
 
 router = APIRouter(prefix="/api/v1/coupon", tags=["coupon"])
 
 
+def _to_int(v: object) -> int | None:
+    """user_id 协议是字符串(登录态才带),转 int 存库;缺失/非法 → None。"""
+    if v is None:
+        return None
+    try:
+        return int(v)  # type: ignore[arg-type]
+    except (TypeError, ValueError):
+        return None
+
+
+def _extract_coupon_results(resp_json: dict) -> list[dict]:
+    """从 pricebot 响应抽本帧券结果,并**按 coupon_id 去重**。
+
+    ⚠️ done/单券帧同时带 last_coupon_result(最后一张)+ action.params.coupon_results
+    (全量含最后一张)→ 最后一张出现两次。必须去重:同批里同 coupon_id 两次,
+    record_claims 在 autoflush=False 下两次 select 都查不到刚 add 的行 → 重复 add →
+    commit 撞唯一约束 IntegrityError 回滚整批(done/单券记录全丢)。
+    coupon_results(全量权威)覆盖 last_coupon_result。"""
+    by_id: dict[str, dict] = {}
+    last = resp_json.get("last_coupon_result")
+    if isinstance(last, dict) and last.get("coupon_id"):
+        by_id[last["coupon_id"]] = last
+    params = (resp_json.get("action") or {}).get("params") or {}
+    cr = params.get("coupon_results")
+    if isinstance(cr, list):
+        for x in cr:
+            if isinstance(x, dict) and x.get("coupon_id"):
+                by_id[x["coupon_id"]] = x
+    return list(by_id.values())
+
+
+def _mark_engagement_blocking(
+    device_id: str, user_id: int | None, engage_type: str
+) -> None:
+    """独立 session 写 engagement(async 端点经 run_in_threadpool 调,不阻塞事件循环)。"""
+    with SessionLocal() as db:
+        coupon_repo.mark_engagement(db, device_id, user_id, engage_type)
+
+
+def _record_claims_blocking(
+    device_id: str, user_id: int | None, trace_id: str | None, results: list[dict]
+) -> None:
+    with SessionLocal() as db:
+        coupon_repo.record_claims(db, device_id, user_id, trace_id, results)
+
+
+def _mark_completed_blocking(
+    device_id: str, user_id: int | None, trace_id: str | None
+) -> None:
+    """独立 session 写"今日已跑完整轮"(到 done 帧那刻调,best-effort 不阻塞领券)。"""
+    with SessionLocal() as db:
+        coupon_repo.mark_completed_today(db, device_id, user_id, trace_id)
+
+
 @router.post("/step", summary="领券任务步进 (透传到 pricebot)")
 async def coupon_step(
     request: Request,
@@ -33,24 +98,48 @@ async def coupon_step(
     - 透传: 不做 schema 校验,pricebot 自己校验
     - 失败: 网络不可达 / pricebot 5xx → 502 + 友好 message
     """
+    # 读原始字节,避免"反序列化→再序列化"的双重 JSON(省透传 CPU)。只 loads 一次拿
+    # trace_id 做亲和 + 打日志,转发时直接发原始 bytes,不重新 dumps。
+    raw = await request.body()
     try:
-        body = await request.json()
+        meta = json.loads(raw)
     except Exception as e:
         raise HTTPException(status_code=400, detail=f"invalid json body: {e}") from e
+    if not isinstance(meta, dict):
+        meta = {}
 
-    url = f"{settings.PRICEBOT_BASE_URL.rstrip('/')}/api/coupon/step"
+    device_id = meta.get("device_id")
+    user_id = _to_int(meta.get("user_id"))  # 登录态才带;判断不靠它,资产留痕用
+    trace_id = meta.get("trace_id")
+
+    # 领券任务首帧(step=0)= 用户已发起领券 → 记一条今日 engagement(claim_started),
+    # 今天这台设备不再弹引导窗(对齐前台"点一键领取即 markEngaged")。写库失败绝不能
+    # 连累领券主流程,整段吞掉。
+    if device_id and meta.get("step") == 0:
+        try:
+            await run_in_threadpool(
+                _mark_engagement_blocking, device_id, user_id, "claim_started"
+            )
+        except Exception as e:  # noqa: BLE001
+            logger.warning("coupon engagement write failed: %s", e)
+
+    # 按 trace_id 一致性 hash 选 pricebot 实例(同一领券任务的所有帧落同一进程)
+    base = pick_pricebot(meta.get("trace_id"))
+    url = f"{base.rstrip('/')}/api/coupon/step"
     timeout = settings.PRICEBOT_REQUEST_TIMEOUT_SEC
 
     logger.info(
         "coupon_step device_id=%s trace_id=%s step=%s",
-        body.get("device_id"),
-        body.get("trace_id"),
-        body.get("step"),
+        meta.get("device_id"),
+        meta.get("trace_id"),
+        meta.get("step"),
     )
 
     try:
         async with httpx.AsyncClient(timeout=timeout) as client:
-            resp = await client.post(url, json=body)
+            resp = await client.post(
+                url, content=raw, headers={"Content-Type": "application/json"}
+            )
     except httpx.RequestError as e:
         logger.error("[pricebot] request failed: %s", e)
         raise HTTPException(
@@ -69,4 +158,81 @@ async def coupon_step(
             detail=f"pricebot upstream returned {resp.status_code}",
         )
 
-    return resp.json()
+    resp_json = resp.json()
+
+    # 领券结果沉淀(资产):中间帧 last_coupon_result + done 帧 coupon_results 幂等写库。
+    # 当前只记录、不参与"要不要领"判断(MVP 先不去重)。写库失败不影响返回。
+    if device_id:
+        results = _extract_coupon_results(resp_json)
+        if results:
+            try:
+                await run_in_threadpool(
+                    _record_claims_blocking, device_id, user_id, trace_id, results
+                )
+            except Exception as e:  # noqa: BLE001
+                logger.warning("coupon claim write failed: %s", e)
+
+    # 整轮跑完(done 帧)→ 记一条"今日已完成",首页「去领取」卡据此置灰。
+    # pricebot 把中途单券 done 改写成 wait+continue=true,只有整套全跑完那帧才保留
+    # command=="done"(见 pricebot main.py),故 done 已等价"整轮完成"(用户决策 A 方案:
+    # 到 done 即算,不管单券成败),无需再判 continue。写库失败绝不连累领券返回。
+    action = resp_json.get("action") or {}
+    if device_id and action.get("command") == "done":
+        try:
+            await run_in_threadpool(
+                _mark_completed_blocking, device_id, user_id, trace_id
+            )
+        except Exception as e:  # noqa: BLE001
+            logger.warning("coupon completion write failed: %s", e)
+
+    return resp_json
+
+
+@router.post("/prompt/dismiss", summary="用户拒绝/关闭领券引导窗(记今日已 engage)")
+def coupon_prompt_dismiss(payload: CouponPromptDismissIn, db: DbSession) -> dict[str, bool]:
+    """客户端点关闭引导窗时调用 → 记一条今日 engagement(dismissed),今天不再弹。
+
+    server 在透传链路里看不到"用户拒绝"(拒绝不发起领券),故必须客户端通知。
+    MVP 不鉴权,按 device_id 记。
+    """
+    coupon_repo.mark_engagement(db, payload.device_id, payload.user_id, "dismissed")
+    return {"ok": True}
+
+
+@router.get(
+    "/prompt/should-show",
+    response_model=CouponPromptShouldShowOut,
+    summary="切到外卖 App 时是否还应弹领券引导窗",
+)
+def coupon_prompt_should_show(
+    device_id: str, db: DbSession
+) -> CouponPromptShouldShowOut:
+    """今天这台设备已 engage(领或拒)过 → should_show=false。客户端据此决定弹不弹
+    (纯后台判据,客户端不再做前台 SP 缓存判断)。"""
+    return CouponPromptShouldShowOut(
+        should_show=not coupon_repo.has_engaged_today(db, device_id)
+    )
+
+
+@router.post("/prompt/reset", summary="重置今日领券引导窗 engagement(开发测频控用)")
+def coupon_prompt_reset(payload: CouponPromptDismissIn, db: DbSession) -> dict[str, bool]:
+    """删这台设备今天的 engagement → has_engaged_today 变 false,今天又能弹。
+    开发设置「重置今日领券弹窗状态」按钮调。MVP 不鉴权,按 device_id。"""
+    coupon_repo.reset_today_engagement(db, payload.device_id)
+    return {"ok": True}
+
+
+@router.get(
+    "/completed-today",
+    response_model=CouponCompletedTodayOut,
+    summary="这台设备今天是否已跑完整轮领券(到 done 帧)",
+)
+def coupon_completed_today(
+    device_id: str, db: DbSession
+) -> CouponCompletedTodayOut:
+    """今天这台设备已跑完整轮(到 done)→ completed=true。客户端据此把首页「去领取」
+    卡置灰、不可点(用户决策 A 方案:到 done 即算,不管单券成败)。判断维度 device_id
+    必须与领券循环上报的一致(客户端两端都用 ANDROID_ID)。"""
+    return CouponCompletedTodayOut(
+        completed=coupon_repo.has_completed_today(db, device_id)
+    )

app/api/v1/feedback.py

@@ -1,7 +1,7 @@
 """帮助与反馈 endpoint。
 
 路由前缀 `/api/v1/feedback`,需 Bearer 鉴权(反馈绑到登录用户,便于回访)。
-  POST /  提交反馈(multipart:content / contact 必填,images 可选 ≤4 张)
+  POST /  提交反馈(multipart:content 必填;contact 可选(原型改版后客户端已不再采集);images 可选 ≤6 张)
 
 截图复用 [app.core.media] 落盘到 /media/feedback/。
 """
@@ -20,7 +20,7 @@ logger = logging.getLogger("shagua.feedback")
 
 router = APIRouter(prefix="/api/v1/feedback", tags=["feedback"])
 
-_MAX_IMAGES = 4
+_MAX_IMAGES = 6
 _CONTENT_MAX = 2000
 _CONTACT_MAX = 128
 
@@ -30,7 +30,8 @@ async def submit_feedback(
     user: CurrentUser,
     db: DbSession,
     content: str = Form(...),
-    contact: str = Form(...),
+    # 原型改版后客户端不再采集联系方式;保留字段以兼容旧端 + 后续可能复用,默认空串。
+    contact: str = Form(default=""),
     images: list[UploadFile] = File(default=[]),
 ) -> FeedbackOut:
     content = content.strip()
@@ -39,8 +40,6 @@ async def submit_feedback(
         raise HTTPException(status_code=400, detail="反馈内容不能为空")
     if len(content) > _CONTENT_MAX:
         raise HTTPException(status_code=400, detail="反馈内容过长")
-    if not contact:
-        raise HTTPException(status_code=400, detail="联系方式不能为空")
     if len(contact) > _CONTACT_MAX:
         raise HTTPException(status_code=400, detail="联系方式过长")
 

app/api/v1/invite.py

@@ -0,0 +1,217 @@
+"""好友邀请 endpoint。
+
+路由前缀 /api/v1/invite,需 Bearer 鉴权(用户级数据);唯一例外是 /landing-track
+(落地页 dl.html 浏览器访问、无 token,详见任务 3 [[invite-three-tasks]]):
+  GET  /me                我的邀请码 + 分享链接 + 已邀人数/已得金币(邀请页展示)
+  POST /bind              把当前登录用户(被邀请人)绑定到某邀请码;支持三种归因:
+                          ① clipboard:首启读剪贴板拿邀请码 → 上报码
+                          ② manual:用户在邀请页输入邀请码 → 上报码
+                          ③ fingerprint:剪贴板没拿到时上报指纹,后端反查
+  POST /landing-track     落地页 dl.html 访问时上报指纹(剪贴板兜底的服务端一端,无需鉴权)
+
+绑定的真正逻辑(邀请码生成/反查、幂等、自邀屏蔽、发金币、指纹反查)在
+repositories/invite.py。
+"""
+from __future__ import annotations
+
+import logging
+import re
+
+from fastapi import APIRouter, Request
+
+from app.api.deps import CurrentUser, DbSession
+from app.core import rewards
+from app.core.config import settings
+from app.repositories import invite as invite_repo
+from app.schemas.invite import (
+    BindInviteIn,
+    BindInviteOut,
+    InviteeItem,
+    InviteeListOut,
+    InviteInfoOut,
+    LandingTrackIn,
+    LandingTrackOut,
+)
+
+logger = logging.getLogger("shagua.invite")
+
+router = APIRouter(prefix="/api/v1/invite", tags=["invite"])
+
+_BIND_MESSAGES = {
+    "success": "邀请绑定成功,金币已到账",
+    "already_bound": "你已绑定过邀请人",
+    "invalid_code": "邀请码无效",
+    "self_invite": "不能填写自己的邀请码",
+    "not_eligible": "邀请仅对新注册用户生效",
+    "fp_not_found": "未匹配到邀请关系",
+}
+
+
+def _client_ip(request: Request) -> str:
+    """从 HTTP 头拿真实 IP。nginx 反代时走 X-Forwarded-For;裸跑 uvicorn 走 request.client。"""
+    xff = request.headers.get("x-forwarded-for", "")
+    if xff:
+        # X-Forwarded-For 可能是 "client, proxy1, proxy2" 链;取第一个 = 真实客户端
+        return xff.split(",")[0].strip()
+    return request.client.host if request.client else ""
+
+
+# Android UA 形如 '... ; <Model> Build/<id>) AppleWebKit/...';抓 ';' 后到 ' Build/' 前
+# 的 token = Build.MODEL(跨端跟客户端 android.os.Build.MODEL 对齐)。user-agents 库
+# 把 Android 设备归为 'Smartphone' 通用名,抓不到真实型号,只能正则。
+_ANDROID_BUILD_MODEL_RE = re.compile(r";\s*([^;]+?)\s+Build/", re.IGNORECASE)
+
+
+def _parse_device_model(ua: str) -> str:
+    """解析浏览器 UA 拿手机型号(如 '24115RA8EC'、'PJF110')。
+
+    Android:正则抓 UA 里 ';...Build/' 前的 token(== Build.MODEL),跨端可严格匹配。
+    iOS / 解析不到:退到 user-agents 库的通用解析,失败/UA 空 → 返空字符串。
+    """
+    if not ua:
+        return ""
+    m = _ANDROID_BUILD_MODEL_RE.search(ua)
+    if m:
+        return m.group(1).strip()
+    try:
+        from user_agents import parse
+        return (parse(ua).device.model or "").strip()
+    except Exception:  # noqa: BLE001
+        return ""
+
+
+@router.get("/me", response_model=InviteInfoOut, summary="我的邀请码 + 分享链接 + 战绩")
+def my_invite(user: CurrentUser, db: DbSession) -> InviteInfoOut:
+    code = invite_repo.ensure_code(db, user)
+    invited, coins = invite_repo.get_stats(db, user.id)
+    sep = "&" if "?" in settings.INVITE_LANDING_URL else "?"
+    share_url = f"{settings.INVITE_LANDING_URL}{sep}ref={code}"
+    return InviteInfoOut(
+        invite_code=code,
+        share_url=share_url,
+        invited_count=invited,
+        coins_earned=coins,
+    )
+
+
+@router.get("/invitees", response_model=InviteeListOut, summary="我邀请的人列表(分页)")
+def my_invitees(
+    user: CurrentUser, db: DbSession, limit: int = 20, offset: int = 0
+) -> InviteeListOut:
+    """邀请页小窗(取前几条) + 完整列表页(分页加载)共用。
+
+    名字/头像的降级兜底在 repositories/invite.get_invitees 算好,这里只组装响应。
+    limit 夹到 [1,50] 防滥用;offset 不小于 0。
+    """
+    limit = max(1, min(limit, 50))
+    offset = max(0, offset)
+    items, total, has_more = invite_repo.get_invitees(
+        db, user.id, limit=limit, offset=offset,
+    )
+    return InviteeListOut(
+        items=[InviteeItem(**it) for it in items],
+        total=total,
+        has_more=has_more,
+    )
+
+
+@router.post(
+    "/landing-track",
+    response_model=LandingTrackOut,
+    summary="落地页指纹采集(无需鉴权)",
+)
+def landing_track(
+    req: LandingTrackIn, request: Request, db: DbSession
+) -> LandingTrackOut:
+    """B 浏览器打开 dl.html?ref=xxx 时上报指纹。
+
+    服务端从 HTTP 头拿 IP/UA、解析 UA 拿 device_model,跟 req.screen 一起入库。
+    无需鉴权(浏览器没 token)。invalid_code / no_ip 走 silent 返回(不抛 5xx 影响下载流程)。
+    """
+    inviter = invite_repo.resolve_inviter(db, req.ref)
+    if inviter is None or inviter.status != "active":
+        return LandingTrackOut(status="invalid_code")
+
+    ip = _client_ip(request)
+    if not ip:
+        return LandingTrackOut(status="no_ip")
+
+    ua_str = request.headers.get("user-agent", "")
+    device_model = _parse_device_model(ua_str)
+
+    invite_repo.record_fingerprint(
+        db,
+        inviter_user_id=inviter.id,
+        ip=ip,
+        screen=req.screen,
+        device_model=device_model,
+        user_agent=ua_str,
+    )
+    logger.info(
+        "invite landing-track inviter=%d ip=%s screen=%s model=%s",
+        inviter.id, ip, req.screen, device_model,
+    )
+    return LandingTrackOut(status="ok")
+
+
+@router.post("/bind", response_model=BindInviteOut, summary="绑定邀请人(注册即生效,双方发金币)")
+def bind_invite(
+    req: BindInviteIn, user: CurrentUser, db: DbSession, request: Request
+) -> BindInviteOut:
+    code = (req.invite_code or "").strip()
+
+    # 路径 1:有邀请码 → 走原路径(clipboard / manual)
+    if code:
+        result = invite_repo.bind(
+            db, invitee=user, invite_code=code, channel=req.channel,
+        )
+        logger.info(
+            "invite bind invitee=%d code=%s channel=%s -> %s",
+            user.id, code, req.channel, result.status,
+        )
+        return BindInviteOut(
+            status=result.status,
+            coins_awarded=result.invitee_coin,
+            message=_BIND_MESSAGES.get(result.status, result.status),
+        )
+
+    # 路径 2:无邀请码 + 有指纹 → 指纹兜底反查
+    if req.fingerprint is not None:
+        ip = _client_ip(request)
+        inviter = invite_repo.resolve_inviter_by_fingerprint(
+            db,
+            ip=ip,
+            screen=req.fingerprint.screen,
+            device_model=req.fingerprint.device_model,
+            window_days=rewards.INVITE_FP_WINDOW_DAYS,
+        )
+        if inviter is None:
+            logger.info(
+                "invite bind invitee=%d fingerprint not_found ip=%s screen=%s model=%s",
+                user.id, ip, req.fingerprint.screen, req.fingerprint.device_model,
+            )
+            return BindInviteOut(
+                status="fp_not_found",
+                coins_awarded=0,
+                message=_BIND_MESSAGES["fp_not_found"],
+            )
+        # 用反查到的 inviter.invite_code 走原 bind 流程(走原幂等/自邀/新人闸/发币逻辑)
+        result = invite_repo.bind(
+            db, invitee=user, invite_code=inviter.invite_code, channel="fingerprint",
+        )
+        logger.info(
+            "invite bind invitee=%d fingerprint -> inviter=%d code=%s -> %s",
+            user.id, inviter.id, inviter.invite_code, result.status,
+        )
+        return BindInviteOut(
+            status=result.status,
+            coins_awarded=result.invitee_coin,
+            message=_BIND_MESSAGES.get(result.status, result.status),
+        )
+
+    # 路径 3:啥都没传 → 无效请求
+    return BindInviteOut(
+        status="invalid_code",
+        coins_awarded=0,
+        message=_BIND_MESSAGES["invalid_code"],
+    )

app/api/v1/meituan.py

@@ -7,10 +7,14 @@ from __future__ import annotations
 import logging
 from concurrent.futures import ThreadPoolExecutor, as_completed
 
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, Depends, HTTPException
+from sqlalchemy import nullslast, select
+from sqlalchemy.orm import Session, aliased
 
 from app.core.config import settings
-from app.integrations.meituan import MeituanCpsError, get_referral_link, query_coupon
+from app.db.session import get_db
+from app.integrations.meituan import MeituanCpsError, _call, get_referral_link, query_coupon
+from app.models.meituan_coupon import MeituanCoupon
 from app.schemas.meituan import (
     CouponCard,
     CouponListRequest,
@@ -19,6 +23,7 @@ from app.schemas.meituan import (
     FeedResponse,
     ReferralLinkRequest,
     ReferralLinkResponse,
+    TopSalesRequest,
 )
 
 logger = logging.getLogger("shagua.meituan")
@@ -29,7 +34,7 @@ router = APIRouter(prefix="/api/v1/meituan", tags=["meituan-cps"])
 @router.post("/coupons", response_model=CouponListResponse, summary="券列表(为您推荐)")
 def list_coupons(req: CouponListRequest) -> CouponListResponse:
     if not settings.mt_cps_configured:
-        return CouponListResponse(items=[], has_next=False, search_id=None)
+        return CouponListResponse(items=[], has_next=False, search_id=None, status="degraded")
     logger.info("[coupons] lon=%.6f lat=%.6f topic=%s", req.longitude, req.latitude, req.list_topic_id)
     try:
         raw = query_coupon(
@@ -45,14 +50,21 @@ def list_coupons(req: CouponListRequest) -> CouponListResponse:
             page_size=req.page_size,
         )
     except MeituanCpsError as e:
-        logger.error("query_coupon failed: %s", e)
-        raise HTTPException(status_code=502, detail=f"meituan: {e}") from e
+        # 软降级:不再抛 502(避免前端弹报错 toast),返空 + degraded,前端显示「服务繁忙」。
+        logger.warning("[coupons] query_coupon 失败,降级返空: %s", e)
+        return CouponListResponse(items=[], has_next=False, search_id=None, status="degraded")
 
-    items = [CouponCard.from_raw(it) for it in (raw.get("data") or [])]
+    items: list[CouponCard] = []
+    for it in (raw.get("data") or []):
+        try:
+            items.append(CouponCard.from_raw(it))
+        except Exception:  # noqa: BLE001
+            continue
     return CouponListResponse(
         items=items,
         has_next=raw.get("hasNext", False),
         search_id=raw.get("searchId"),
+        status="ok" if items else "empty",
     )
 
 
@@ -79,36 +91,145 @@ def _interleave(waimai: list[dict], daodian: list[dict]) -> list[CouponCard]:
     return items
 
 
-@router.post("/feed", response_model=FeedResponse, summary="混合feed(外卖+到店交叉, 无限流)")
-def feed(req: FeedRequest) -> FeedResponse:
-    if not settings.mt_cps_configured:
-        return FeedResponse(items=[], has_next=False, page=req.page)
-    page_idx = req.page - 1
-    lon, lat = req.longitude, req.latitude
-    logger.info("[feed] page=%s lon=%.6f lat=%.6f", req.page, lon, lat)
+def _commission_pct(card: CouponCard) -> float:
+    """'1.4%' → 1.4;解析失败按 0(会被智能推荐过滤掉)。"""
+    try:
+        return float(card.commission_rate.rstrip("%"))
+    except (ValueError, AttributeError):
+        return 0.0
 
-    def _fetch_topic(platform: int, biz_line: int | None, topic: int) -> list[dict]:
+
+@router.post("/feed", response_model=FeedResponse, summary="混合feed(外卖+到店交叉);tab=rec智能推荐/distance距离最近")
+def feed(req: FeedRequest, db: Session = Depends(get_db)) -> FeedResponse:
+    lon, lat = req.longitude, req.latitude
+    tab = (req.tab or "").strip()
+    logger.info("[feed] tab=%s page=%s lon=%.6f lat=%.6f", tab or "(default)", req.page, lon, lat)
+
+    # rec 是纯离线库查询,不依赖 MT 凭证、不实时打美团;其余 tab(distance / 默认)要实时打美团,
+    # 未配凭证直接降级返空(degraded),让前端区分「服务暂不可用」而非「暂无」。
+    if tab != "rec" and not settings.mt_cps_configured:
+        return FeedResponse(items=[], has_next=False, page=req.page, status="degraded")
+
+    def _fetch_topic(platform: int, biz_line: int | None, topic: int) -> tuple[list[dict], bool]:
+        """返回(items, 是否调用失败)。失败标志用于把默认 feed 整页标 degraded。"""
         try:
-            return (query_coupon(
+            data = (query_coupon(
                 longitude=lon, latitude=lat,
                 platform=platform, biz_line=biz_line,
                 list_topic_id=topic, page_size=20,
             ).get("data") or [])
+            return data, False
         except MeituanCpsError:
-            return []
+            return [], True
 
+    # 距离最近:搜索召回(外卖搜"外卖" + 到店搜"美食",都 sortField=6 离我最近)一页页拉。
+    # 搜索翻页必须用 searchId(pageNo 翻不动),所以每个 feed 页顺序翻到第 N 页;两路并行、page 1 最快。
+    # 无状态、不改 APP(传页码即可);按你位置实时算距离(库里没存 POI 经纬度,只能实时)。
+    if tab == "distance":
+        lon_i, lat_i = int(lon * 1_000_000), int(lat * 1_000_000)
+
+        def _search_page_n(platform: int, biz_line: int | None, keyword: str, n: int) -> tuple[list[dict], bool, bool]:
+            """顺序翻到第 n 页(搜索须 searchId 续页),返回(第 n 页 items, 是否还有下一页, 是否调用失败)。"""
+            sid: str | None = None
+            data: list[dict] = []
+            has_next = False
+            for pg in range(1, n + 1):
+                body: dict = {
+                    "platform": platform, "searchText": keyword, "sortField": 6,
+                    "longitude": lon_i, "latitude": lat_i, "pageSize": 20,
+                }
+                if biz_line is not None:
+                    body["bizLine"] = biz_line
+                if sid:
+                    body["searchId"] = sid
+                else:
+                    body["pageNo"] = 1
+                try:
+                    r = _call("/cps_open/common/api/v1/query_coupon", body)
+                except MeituanCpsError:
+                    return [], False, True   # 调用失败(用于标 degraded)
+                data = r.get("data") or []
+                sid = r.get("searchId")
+                has_next = bool(r.get("hasNext")) and bool(data)
+                if not data or (not has_next and pg < n):
+                    return [], False, False   # 没那么多页了(非错误)
+            return data, has_next, False
+
+        with ThreadPoolExecutor(max_workers=2) as pool:
+            f_wm = pool.submit(_search_page_n, 1, None, "外卖", req.page)
+            f_dd = pool.submit(_search_page_n, 2, 1, "美食", req.page)
+            (wm_data, wm_hn, wm_fail), (dd_data, dd_hn, dd_fail) = f_wm.result(), f_dd.result()
+
+        seen: set[str] = set()
+        cards: list[CouponCard] = []
+        for it in wm_data + dd_data:
+            try:
+                card = CouponCard.from_raw(it)
+            except Exception:  # noqa: BLE001
+                continue
+            if card.product_view_sign and card.product_view_sign not in seen:
+                seen.add(card.product_view_sign)
+                cards.append(card)
+        cards.sort(key=lambda c: c.distance_meters if c.distance_meters is not None else float("inf"))
+        # 两路都失败且无数据 → degraded;否则有数据 ok / 无数据 empty
+        status = "degraded" if (not cards and wm_fail and dd_fail) else ("ok" if cards else "empty")
+        return FeedResponse(items=cards, has_next=wm_hn or dd_hn, page=req.page, status=status)
+
+    # 智能推荐(rec):走【离线库】筛佣金率 ≥ 3%,分页返回(SQL 侧去重+排序+分页,秒级、不打美团)。
+    # 实测库里佣金≥3% 去重后仅 ~578 条(几乎全是外卖;到店团购佣金普遍 <3%):实时按"同城热销榜单"
+    # 拉既撞限流、又填不满(该榜单中位佣金 ~0.8%,筛完每页剩 0-1 条),故从库出。佣金阈值逻辑不变。
+    if tab == "rec":
+        PAGE = 20
+        try:
+            base = select(MeituanCoupon).where(MeituanCoupon.commission_percent >= 3.0)
+            deduped = base.distinct(MeituanCoupon.dedup_key).order_by(
+                MeituanCoupon.dedup_key,
+                MeituanCoupon.commission_percent.desc(),
+            ).subquery()
+            m = aliased(MeituanCoupon, deduped)
+            start = (req.page - 1) * PAGE
+            rows = db.execute(
+                select(m)
+                # 销量高的优先(无销量档排后),同档佣金高优先,id 兜底稳定分页
+                .order_by(nullslast(m.sale_volume_num.desc()), m.commission_percent.desc(), m.id)
+                .offset(start)
+                .limit(PAGE + 1)
+            ).scalars().all()
+        except Exception:  # noqa: BLE001
+            logger.exception("[feed] rec 库查询失败,降级返空")
+            return FeedResponse(items=[], has_next=False, page=req.page, status="degraded")
+        has_next = len(rows) > PAGE
+        cards: list[CouponCard] = []
+        for row in rows[:PAGE]:
+            try:
+                card = CouponCard.from_raw(row.raw or {})
+            except Exception:  # noqa: BLE001
+                continue
+            if card.product_view_sign:
+                # 智能推荐不显示距离:库里的距离是相对城市默认点的(对用户无意义、且误导)。
+                # 置空后前端"距离 店名"那行只剩店名、自动顶到最左(店名移到原距离的位置)。
+                card.distance_text = None
+                card.distance_meters = None
+                cards.append(card)
+        return FeedResponse(items=cards, has_next=has_next, page=req.page,
+                            status="ok" if cards else "empty")
+
+    # 默认(老客户端不传 tab):沿用逐轮分页的混合 feed,不筛。
+    page_idx = req.page - 1
     if page_idx >= len(_TOPIC_ROUNDS):
-        return FeedResponse(items=[], has_next=False, page=req.page)
+        return FeedResponse(items=[], has_next=False, page=req.page, status="empty")
 
     wm_topic, dd_topic = _TOPIC_ROUNDS[page_idx]
     with ThreadPoolExecutor(max_workers=2) as pool:
         f_wm = pool.submit(_fetch_topic, 1, None, wm_topic)
         f_dd = pool.submit(_fetch_topic, 2, 1, dd_topic)
-        waimai, daodian = f_wm.result(), f_dd.result()
+        (waimai, wm_fail), (daodian, dd_fail) = f_wm.result(), f_dd.result()
 
     items = _interleave(waimai, daodian)
     has_next = page_idx + 1 < len(_TOPIC_ROUNDS)
-    return FeedResponse(items=items, has_next=has_next, page=req.page)
+    # 两路都失败且无数据 → degraded;否则有数据 ok / 无数据 empty
+    status = "degraded" if (not items and wm_fail and dd_fail) else ("ok" if items else "empty")
+    return FeedResponse(items=items, has_next=has_next, page=req.page, status=status)
 
 
 @router.post("/referral-link", response_model=ReferralLinkResponse, summary="换取推广链接(点抢时调)")
@@ -130,3 +251,47 @@ def referral_link(req: ReferralLinkRequest) -> ReferralLinkResponse:
     link_map = raw.get("referralLinkMap") or {}
     link = raw.get("data") or link_map.get("1") or link_map.get("3") or next(iter(link_map.values()), "")
     return ReferralLinkResponse(link=link, link_map=link_map)
+
+
+@router.post("/top-sales", response_model=CouponListResponse,
+             summary="销量最高(从离线库 meituan_coupon 按销量降序 + 跨源去重,不实时打美团)")
+def top_sales(req: TopSalesRequest, db: Session = Depends(get_db)) -> CouponListResponse:
+    # 去重 + 排序 + 分页全在 SQL 做,每页只取并解析当前页 ~20 条。
+    # (之前实现每翻一页都全表拉取 + 全量 from_raw 解析,翻页慢 → 客户端滑动卡顿/翻不动。)
+    # 库为空(prod 刚部署 / ETL 未跑完)时返空 + status=empty,不崩;库查询异常降级 degraded。
+    try:
+        # 1) DISTINCT ON (dedup_key):每个去重键(品牌|名|价)只留销量最高那条(同销量再按佣金)
+        base = select(MeituanCoupon).where(MeituanCoupon.sale_volume_num.isnot(None))
+        if req.platform is not None:
+            base = base.where(MeituanCoupon.platform == req.platform)
+        deduped = base.distinct(MeituanCoupon.dedup_key).order_by(
+            MeituanCoupon.dedup_key,
+            MeituanCoupon.sale_volume_num.desc(),
+            MeituanCoupon.commission_percent.desc(),
+        ).subquery()
+
+        # 2) 对去重结果按销量降序分页;多取 1 条判断 has_next,只对本页做 from_raw
+        m = aliased(MeituanCoupon, deduped)
+        start = (req.page - 1) * req.page_size
+        rows = db.execute(
+            select(m)
+            # 加 id 作稳定 tiebreaker:同销量同佣金的并列项排序确定,避免跨页重复/漏项
+            .order_by(m.sale_volume_num.desc(), m.commission_percent.desc(), m.id)
+            .offset(start)
+            .limit(req.page_size + 1)
+        ).scalars().all()
+    except Exception:  # noqa: BLE001
+        logger.exception("[top-sales] 库查询失败,降级返空")
+        return CouponListResponse(items=[], has_next=False, search_id=None, status="degraded")
+
+    has_next = len(rows) > req.page_size
+    cards: list[CouponCard] = []
+    for row in rows[:req.page_size]:
+        try:
+            card = CouponCard.from_raw(row.raw or {})
+        except Exception:  # noqa: BLE001
+            continue
+        if card.product_view_sign:
+            cards.append(card)
+    return CouponListResponse(items=cards, has_next=has_next, search_id=None,
+                              status="ok" if cards else "empty")