fix: 全面修复项目问题

后端修复:
- 验证码存储与校验机制
- 订单创建事务+库存扣减
- GetStats字段名错误
- VerifyEmail改为POST
- 供应商更新字段白名单
- 文件删除安全检查
- 抽奖安全随机数
- 用户管理CRUD
- 订单取消/确认收货
- 工单回复
- Toggle返回新数据
- 移除死代码

前端修复:
- 404兜底路由
- 401软跳转
- API层统一
- 面包屑补充banners
- 国际化完善
- 购物车并行删除
- 退出清理购物车
- 供应商Dashboard数据
- 工单详情页
- 订单取消/确认收货

backend/internal/api/routes/routes.go

@@ -5,8 +5,6 @@ import (
 
 	"sale/internal/api/handlers"
 	"sale/internal/api/middlewares"
-	"sale/internal/models"
-	"sale/internal/utils"
 
 	"github.com/gin-gonic/gin"
 )
@@ -26,6 +24,7 @@ func SetupRoutes(r *gin.Engine) {
 	inventoryHandler := handlers.NewInventoryHandler()
 	articleHandler := handlers.NewArticleHandler()
 	uploadHandler := handlers.NewUploadHandler()
+	bannerHandler := handlers.NewBannerHandler()
 
 	r.Use(middlewares.CORSMiddleware())
 
@@ -40,7 +39,7 @@ func SetupRoutes(r *gin.Engine) {
 			auth.POST("/login", authHandler.Login)
 			auth.POST("/forgot-password", authHandler.ForgotPassword)
 			auth.POST("/reset-password", authHandler.ResetPassword)
-			auth.GET("/verify-email", authHandler.VerifyEmail)
+			auth.POST("/verify-email", authHandler.VerifyEmail)
 		}
 
 		articles := api.Group("/articles")
@@ -51,6 +50,8 @@ func SetupRoutes(r *gin.Engine) {
 			articles.POST("/crawl-ribenyan", articleHandler.CrawlRibenyan)
 		}
 
+		api.GET("/banners", bannerHandler.List)
+
 		api.GET("/categories", categoryHandler.List)
 		api.GET("/brands", brandHandler.List)
 		api.GET("/products", productHandler.List)
@@ -97,6 +98,8 @@ func SetupRoutes(r *gin.Engine) {
 				orders.GET("/:id", orderHandler.GetByID)
 				orders.POST("", orderHandler.Create)
 				orders.POST("/:id/refund", orderHandler.Refund)
+				orders.PUT("/:id/cancel", orderHandler.CancelOrder)
+				orders.PUT("/:id/confirm-receipt", orderHandler.ConfirmReceipt)
 			}
 
 			lotteries := authed.Group("/lotteries")
@@ -109,6 +112,7 @@ func SetupRoutes(r *gin.Engine) {
 				tickets.GET("", ticketHandler.List)
 				tickets.POST("", ticketHandler.Create)
 				tickets.GET("/:id", ticketHandler.GetByID)
+				tickets.POST("/:id/reply", ticketHandler.Reply)
 			}
 
 			supplier := authed.Group("/supplier")
@@ -126,11 +130,9 @@ func SetupRoutes(r *gin.Engine) {
 			admin.Use(middlewares.RoleMiddleware("admin"))
 			{
 				admin.GET("/stats", systemHandler.GetStats)
-				admin.GET("/users", func(c *gin.Context) {
-					var users []models.User
-					utils.DB.Select("id, username, email, role, purchase_credits, is_active, created_at").Find(&users)
-					c.JSON(200, gin.H{"data": users})
-				})
+			admin.GET("/users", authHandler.AdminGetUsers)
+			admin.PUT("/users/:id", authHandler.AdminUpdateUser)
+			admin.DELETE("/users/:id", authHandler.AdminDeleteUser)
 
 				adminCategories := admin.Group("/categories")
 				{
@@ -203,6 +205,15 @@ func SetupRoutes(r *gin.Engine) {
 					adminArticles.DELETE("/:id", articleHandler.Delete)
 					adminArticles.PUT("/:id/pin", articleHandler.TogglePin)
 				}
+
+				adminBanners := admin.Group("/banners")
+				{
+					adminBanners.GET("", bannerHandler.AdminList)
+					adminBanners.POST("", bannerHandler.Create)
+					adminBanners.PUT("/:id", bannerHandler.Update)
+					adminBanners.DELETE("/:id", bannerHandler.Delete)
+					adminBanners.PUT("/:id/toggle", bannerHandler.ToggleActive)
+				}
 			}
 		}
 	}