fix: 修复数据库配置和事务一致性问题

数据库配置:
- SQLite 开启 WAL 模式，读写可并发
- 设置 busy_timeout=5000ms 避免锁超时
- 设置 synchronous=NORMAL 平衡性能和安全
- SQLite MaxOpenConns 设为 1 避免并发写入冲突

事务修复:
- auth.go: 注册流程(用户+设备+会话)加入事务
- auth.go: 密码重置(修改密码+标记验证码)加入事务
- cards.go: 卡密使用加入事务，补充 UsedAt 字段
- cards.go: 代理商批量生成(扣款+生成卡密)加入事务
- extension.go: 充值(修改余额+记录)加入事务
- extension.go: 扣费(修改余额+记录)加入事务
- storage_config.go: 设置默认存储加入事务

backend/internal/router/app/auth.go

@@ -313,7 +313,15 @@ func handleAppRegister(c *gin.Context) {
 		}
 	}
 
-	if err := database.DB.Create(&user).Error; err != nil {
+	tx := database.DB.Begin()
+	defer func() {
+		if r := recover(); r != nil {
+			tx.Rollback()
+		}
+	}()
+
+	if err := tx.Create(&user).Error; err != nil {
+		tx.Rollback()
 		log.Printf("[DEBUG] Failed to create user: %v", err)
 		response.Error(c, 500, "注册失败")
 		return
@@ -330,7 +338,7 @@ func handleAppRegister(c *gin.Context) {
 		}
 
 		var device model.UserDevice
-		if err := database.DB.Where("user_id = ? AND application_id = ? AND device_id = ?", user.ID, appModel.ID, req.DeviceID).First(&device).Error; err != nil {
+		if err := tx.Where("user_id = ? AND application_id = ? AND device_id = ?", user.ID, appModel.ID, req.DeviceID).First(&device).Error; err != nil {
 			device = model.UserDevice{
 				UserID:        user.ID,
 				ApplicationID: appModel.ID,
@@ -339,7 +347,7 @@ func handleAppRegister(c *gin.Context) {
 				DeviceType:    deviceType,
 				Status:        "active",
 			}
-			if err := database.DB.Create(&device).Error; err != nil {
+			if err := tx.Create(&device).Error; err != nil {
 				log.Printf("[DEBUG] Failed to create device: %v", err)
 			} else {
 				log.Printf("[DEBUG] Successfully created device with ID: %d, type: %s", device.ID, deviceType)
@@ -353,7 +361,7 @@ func handleAppRegister(c *gin.Context) {
 
 		if device.ID > 0 {
 			var session model.DeviceSession
-			sessionErr := database.DB.Where("device_id = ? AND instance_id = ?", device.ID, instanceID).First(&session).Error
+			sessionErr := tx.Where("device_id = ? AND instance_id = ?", device.ID, instanceID).First(&session).Error
 
 			if sessionErr != nil {
 				session = model.DeviceSession{
@@ -363,18 +371,20 @@ func handleAppRegister(c *gin.Context) {
 					InstanceID:    instanceID,
 					LastHeartbeat: &now,
 				}
-				if err := database.DB.Create(&session).Error; err != nil {
+				if err := tx.Create(&session).Error; err != nil {
 					log.Printf("[DEBUG] Failed to create session: %v", err)
 				}
 			} else {
 				session.LastHeartbeat = &now
-				if err := database.DB.Save(&session).Error; err != nil {
+				if err := tx.Save(&session).Error; err != nil {
 					log.Printf("[DEBUG] Failed to update session: %v", err)
 				}
 			}
 		}
 	}
 
+	tx.Commit()
+
 	service.LogVerification(c, &appModel.ID, &user.ID, "register", "用户注册: "+req.Username, req.DeviceID, nil)
 
 	response.SuccessWithMessage(c, "注册成功", gin.H{
@@ -903,14 +913,24 @@ func handleAppResetPassword(c *gin.Context) {
 		return
 	}
 
+	tx := database.DB.Begin()
+	defer func() {
+		if r := recover(); r != nil {
+			tx.Rollback()
+		}
+	}()
+
 	user.Password = string(hashedPassword)
-	if err := database.DB.Save(&user).Error; err != nil {
+	if err := tx.Save(&user).Error; err != nil {
+		tx.Rollback()
 		response.Error(c, 500, "密码重置失败")
 		return
 	}
 
 	verifyCode.Used = true
-	database.DB.Save(&verifyCode)
+	tx.Save(&verifyCode)
+
+	tx.Commit()
 
 	response.Success(c, gin.H{
 		"message": "密码重置成功",