fix: 全面修复项目问题

后端修复:
- 验证码存储与校验机制
- 订单创建事务+库存扣减
- GetStats字段名错误
- VerifyEmail改为POST
- 供应商更新字段白名单
- 文件删除安全检查
- 抽奖安全随机数
- 用户管理CRUD
- 订单取消/确认收货
- 工单回复
- Toggle返回新数据
- 移除死代码

前端修复:
- 404兜底路由
- 401软跳转
- API层统一
- 面包屑补充banners
- 国际化完善
- 购物车并行删除
- 退出清理购物车
- 供应商Dashboard数据
- 工单详情页
- 订单取消/确认收货

backend/internal/api/handlers/lottery.go

@@ -1,7 +1,8 @@
 package handlers
 
 import (
-	"math/rand"
+	"crypto/rand"
+	"math/big"
 	"net/http"
 	"strconv"
 	"time"
@@ -193,7 +194,6 @@ func (h *LotteryHandler) Draw(c *gin.Context) {
 	}
 
 	var winners []models.LotteryWinner
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
 
 	for _, prize := range lottery.Prizes {
 		remaining := prize.Quantity
@@ -223,7 +223,10 @@ func (h *LotteryHandler) Draw(c *gin.Context) {
 
 		selected := make(map[uint]bool)
 		for remaining > 0 && len(selected) < len(selectedParticipants) {
-			r := rng.Intn(totalWeight)
+			r, err := rand.Int(rand.Reader, big.NewInt(int64(totalWeight)))
+			if err != nil {
+				break
+			}
 			cumWeight := 0
 			for _, p := range selectedParticipants {
 				if selected[p.UserID] {
@@ -234,7 +237,7 @@ func (h *LotteryHandler) Draw(c *gin.Context) {
 					w = 1
 				}
 				cumWeight += w
-				if cumWeight > r {
+				if cumWeight > int(r.Int64()) {
 					winner := models.LotteryWinner{
 						LotteryID: lottery.ID,
 						PrizeID:   prize.ID,