feat: 新增账户资料页与头像上传

将工作人员和用户的详情、编辑改为独立账户资料页。

增加受控头像上传与读取、图片安全校验、接口测试，并优化只读及编辑布局。

同步更新平台需求、接口安全说明、项目文档和操作日志。

backend/api/internal/routers/platform.go

@@ -186,11 +186,13 @@ func registerCommerceRoute(group *gin.RouterGroup) {
 
 func registerStaffRoute(group *gin.RouterGroup) {
 	registerWritableResource(group, "/staff_account", staff.ListStaff, staff.CreateStaff, staff.GetStaff, staff.UpdateStaff, &models.StaffAccount{})
+	group.GET("/staff_account/:identity/avatar", staff.GetStaffAvatar)
 	registerWritableResource(group, "/staff_credential", staff.ListStaffCredential, staff.CreateStaffCredential, staff.GetStaffCredential, staff.UpdateStaffCredential, &models.StaffCredential{})
 }
 
 func registerUserRoute(group *gin.RouterGroup) {
 	registerWritableResource(group, "/user_account", userlogic.ListUser, userlogic.CreateUser, userlogic.GetUser, userlogic.UpdateUser, &models.UserAccount{})
+	group.GET("/user_account/:identity/avatar", userlogic.GetUserAvatar)
 	registerWritableResource(group, "/user_address", userlogic.ListUserAddress, userlogic.CreateUserAddress, userlogic.GetUserAddress, userlogic.UpdateUserAddress, &models.UserAddress{})
 	registerWritableResource(group, "/user_service_relation", userlogic.ListUserServiceRelation, userlogic.CreateUserServiceRelation, userlogic.GetUserServiceRelation, userlogic.UpdateUserServiceRelation, &models.UserServiceRelation{})
 }

backend/api/internal/routers/platform_test.go

@@ -109,6 +109,8 @@ func TestPlatformOrganizationAndAccountRoutesExposeResourceCRUD(t *testing.T) {
 	assertNoRouteMethods(t, routes, "/heqi/platform/v1/platform_menu", http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete)
 	assertNoRouteMethods(t, routes, "/heqi/platform/v1/platform_menu/:identity", http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete)
 	assertRouteMethods(t, routes, "/heqi/platform/v1/platform_role/:identity/menu", http.MethodGet, http.MethodPut)
+	assertRouteMethods(t, routes, "/heqi/platform/v1/staff_account/:identity/avatar", http.MethodGet)
+	assertRouteMethods(t, routes, "/heqi/platform/v1/user_account/:identity/avatar", http.MethodGet)
 	assertNoRouteMethods(t, routes, "/heqi/platform/v1/platform_role/:identity/menus", http.MethodGet, http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete)
 	assertNoRouteMethods(t, routes, "/heqi/platform/v1/platfrom_account", http.MethodGet, http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete)
 }

backend/api/internal/routers/upload.go

@@ -11,4 +11,5 @@ func registerUploadRoute(serviceKey string, engine *gin.Engine) {
 	authorized := engine.Group("/upload")
 	authorized.Use(sdkmiddleware.JwtAuth(true))
 	authorized.POST("/file", upload.UploadFile)
+	authorized.POST("/avatar", upload.UploadAvatar)
 }

backend/api/internal/routers/upload_test.go

@@ -0,0 +1,25 @@
+// Package routers 测试受鉴权上传端点的路由注册。
+// 版本：v1.0.0
+package routers
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+// TestUploadRoutesExposeDedicatedAvatarEndpoint 验证专用头像上传路由已注册且不改变原文件上传路由。
+func TestUploadRoutesExposeDedicatedAvatarEndpoint(t *testing.T) {
+	engine := gin.New()
+	registerUploadRoute("heqi", engine)
+	routes := make(map[string]map[string]bool)
+	for _, route := range engine.Routes() {
+		if routes[route.Path] == nil {
+			routes[route.Path] = make(map[string]bool)
+		}
+		routes[route.Path][route.Method] = true
+	}
+	assertRouteMethods(t, routes, "/upload/file", http.MethodPost)
+	assertRouteMethods(t, routes, "/upload/avatar", http.MethodPost)
+}