chore: merge remaining platform audit workspace files

backend/go.work.sum

@@ -1,49 +1,106 @@
+cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
 cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
+cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 h1:DHa2U07rk8syqvCge0QIGMCE1WxGj9njT44GH7zNJLQ=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
+github.com/antihax/optional v1.0.0 h1:xK2lYat7ZLaVVcIuj82J8kIro4V6kDe0AUDFboUCwcg=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=
 github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/elastic/elastic-transport-go/v8 v8.9.0 h1:KeT/2P54F0xS0S8Y3Pf+tFDg4HmBgReQMB+BMz8dDAs=
 github.com/elastic/elastic-transport-go/v8 v8.9.0/go.mod h1:ssMTvNS2hwf7CaiGsRRsx4gQHFZ/jS/DkLcISxekWzc=
+github.com/elastic/go-elasticsearch/v9 v9.4.1 h1:pEF8xlnL8D2WdVp4HRHhGNUwC5QHdgk0DZKrJY0WCNs=
 github.com/elastic/go-elasticsearch/v9 v9.4.1/go.mod h1:IKW8WkW++PW8If95XqfMffGjoFrzHCpsKmWgYk5j3fQ=
+github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
 github.com/envoyproxy/go-control-plane v0.14.0/go.mod h1:NcS5X47pLl/hfqxU70yPwL9ZMkUlwlKxtAohpi2wBEU=
+github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=
 github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
+github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=
 github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
+github.com/godbus/dbus/v5 v5.0.4 h1:9349emZab16e7zQvpmsbtjc18ykshndd8y2PG3sgJbA=
+github.com/golang/glog v1.2.5 h1:DrW6hGnjIhtvhOIiAKT6Psh/Kd/ldepEa81DKeiRJ5I=
 github.com/golang/glog v1.2.5/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
+github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
+github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 h1:qnpSQwGEnkcRpTqNOIR6bJbR0gAorgP9CSALpRcKoAA=
 github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1/go.mod h1:lXGCsh6c22WGtjr+qGHj1otzZpV/1kwTMAqkwZsnWRU=
+github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0 h1:pRhl55Yx1eC7BZ1N+BBWwnKaMyD8uC+34TLdndZMAKk=
 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0/go.mod h1:XKMd7iuf/RGPSMJ/U4HP0zS2Z9Fh8Ps9a+6X26m/tmI=
+github.com/jordanlewis/gcassert v0.0.0-20250430164644-389ef753e22e h1:a+PGEeXb+exwBS3NboqXHyxarD9kaboBbrSp+7GuBuc=
 github.com/jordanlewis/gcassert v0.0.0-20250430164644-389ef753e22e/go.mod h1:ZybsQk6DWyN5t7An1MuPm1gtSZ1xDaTXS9ZjIOxvQrk=
+github.com/kisielk/errcheck v1.5.0 h1:e8esj/e4R+SAOwFwN+n3zr0nYeCyeweozKfO23MvHzY=
+github.com/kisielk/gotool v1.0.0 h1:AV2c/EiW3KqPNT9ZKl07ehoAGi4C5/01Cfbblndcapg=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/nats-io/nats.go v1.52.0 h1:n3avV4VBsCgsdwh71TppsTwtv+QdPs7ntSKM8qJLGsc=
 github.com/nats-io/nats.go v1.52.0/go.mod h1:26HypzazeOkyO3/mqd1zZd53STJN0EjCYF9Uy2ZOBno=
+github.com/nats-io/nkeys v0.4.15 h1:JACV5jRVO9V856KOapQ7x+EY8Jo3qw1vJt/9Jpwzkk4=
 github.com/nats-io/nkeys v0.4.15/go.mod h1:CpMchTXC9fxA5zrMo4KpySxNjiDVvr8ANOSZdiNfUrs=
+github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
 github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
+github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30 h1:BHT1/DKsYDGkUgQ2jmMaozVcdk+sVfz0+1ZJq4zkWgw=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
+github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
 github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
 github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/rogpeppe/fastuuid v1.2.0 h1:Ppwyp6VYCF1nvBTXL3trRso7mXMlRrw9ooo375wvi2s=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
+github.com/shirou/gopsutil v3.21.11+incompatible h1:+1+c1VGhc88SSonWP6foOcLhvnKlUeu/erjjvaPEYiI=
 github.com/shirou/gopsutil v3.21.11+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA=
+github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
 github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/tklauser/go-sysconf v0.4.0 h1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=
 github.com/tklauser/go-sysconf v0.4.0/go.mod h1:8mTNWyog7H+MpKijp4VmKJAd2bbYQ2zuUwkYRbUArPI=
+github.com/tklauser/numcpus v0.12.0 h1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=
 github.com/tklauser/numcpus v0.12.0/go.mod h1:ABHeXzJnr/qqwguhClkZKT1/8VABcYrsyUiUGobwWJg=
+github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.2.0 h1:bYKF2AEwG5rqd1BumT4gAnvwU/M9nBp2pTSxeZw7Wvs=
 github.com/xdg-go/scram v1.2.0/go.mod h1:3dlrS0iBaWKYVt2ZfA4cj48umJZ+cAEbR6/SjLA88I8=
+github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
 github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
+github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
+github.com/yuin/goldmark v1.2.1 h1:ruQGxdhGHe7FWOJPT0mKs5+pD2Xs1Bm/kdGlHO04FmM=
+github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+go.opentelemetry.io/contrib/detectors/gcp v1.42.0 h1:kpt2PEJuOuqYkPcktfJqWWDjTEd/FNgrxcniL7kQrXQ=
 go.opentelemetry.io/contrib/detectors/gcp v1.42.0/go.mod h1:W9zQ439utxymRrXsUOzZbFX4JhLxXU4+ZnCt8GG7yA8=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
 golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
 golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
 golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
+gorm.io/driver/sqlite v1.6.0 h1:WHRRrIiulaPiPFmDcod6prc4l2VGVWHz80KspNsxSfQ=
 gorm.io/driver/sqlite v1.6.0/go.mod h1:AO9V1qIQddBESngQUKWL9yoH93HIeA1X6V633rBwyT8=
+rsc.io/pdf v0.1.1 h1:k1MczvYDUvJBe93bYd7wrZLLUEcLZAuF824/I4e5Xr4=
 rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=

docs/superpowers/plans/2026-07-27-platform-admin-full-audit.md

@@ -0,0 +1,365 @@
+# 平台总后台全量审计与修复 Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** 让后台模型、API、菜单、路由和 Vue 页面完整符合需求分析，并以自动检查证明逐资源连通。
+
+**Architecture:** 后端以受约束的资源定义复用分页、按 `identity` 查询、状态更新和归档；账户、角色、菜单、事件处置与审批保留专用处理器。前端通过同一资源声明驱动标准 CRUD、只读和树页面，专用看板与轨迹页面独立实现。
+
+**Tech Stack:** Go 1.26、Gin、GORM、Vue 3、TypeScript、Arco Design Vue、Vite、Biome、pnpm。
+
+## Global Constraints
+
+- 将未提交的 `backend/api/internal/logic/platform` 文件视为本次可修改的审计基线。
+- 气站名称和路由固定为 `gas_basic`，不得改用 `gas_station`。
+- 设备管理是一级领域，涵盖瓶阀、绑定、遥测、安全规则、事件、处置和安检。
+- 所有模型和字段均保留准确的中文注释。
+- HTTP 只传 UUID V7 `identity`，字段使用 `snake_case`，金额使用最小货币单位整数。
+- 主数据以 `status=archived` 归档；钱包、流水、充值、提现、报表和审计只读。
+- 每项功能先写失败测试或审计断言，再写最小实现；每领域独立验证并提交。
+
+## File Structure
+
+- `backend/api/internal/logic/platform/resource.go`：资源定义、通用 CRUD、只读限制和字段白名单。
+- `backend/api/internal/logic/platform/{organization,device,commerce,finance,content,audit}.go`：领域资源和专用动作。
+- `backend/api/internal/routers/platform.go`：领域 API 注册。
+- `backend/api/internal/models/*.go`：模型字段、关联、索引和中文注释修订。
+- `backend/api/internal/{logic/platform,routers}/*_test.go`：资源契约、路由、只读和角色保护测试。
+- `frontend/platform_admin/src/api/resources.ts`：资源键、路径、页面类型和表单字段的唯一声明。
+- `frontend/platform_admin/src/views/shared/{CrudListPage,ReadOnlyListPage,TreePage}.vue`：三类可复用页面。
+- `frontend/platform_admin/src/views/**/ListPage.vue`：资源声明页面；看板和轨迹使用专用组件。
+- `frontend/platform_admin/src/router/routes/modules/platform.ts`：完整菜单和路由树。
+- `frontend/platform_admin/scripts/audit-check.mjs`：模型、路由、前端 API、页面的静态一致性检查。
+
+## Resource Contract
+
+可写资源：`gas_basic`、`gas_account`、`delivery_basic`、`delivery_account`、`staff_account`、`staff_credential`、`user_account`、`user_address`、`user_service_relation`、`dev_smart_cylinder_valve`、`dev_device_binding`、`saf_rule`、`saf_event`、`saf_inspection`、`ec_category`、`ec_product`、`ec_product_attribute`、`ec_product_image`、`ec_cart`、`ec_order`、`ec_review`、`delivery_task`、`delivery_track`、`delivery_track_point`、`fin_payment`、`fin_settlement`、`fin_reconciliation`、`cnt_content`、`ntf_template`、`cs_ticket`、`platfrom_account`、`platform_role`、`platform_menu`。
+
+只读资源：`dev_telemetry`、`wallet`、`wallet_ledger`、`wallet_recharge`、`wallet_withdrawal`、`report`、`report_item`、`report_metric_snapshot`、`aud_operation_log`、`aud_export_log`、`aud_approval`。`saf_event_disposal` 是仅追加的事件动作记录。
+
+### Task 1: 建立资源契约和审计基线
+
+**Files:**
+- Create: `backend/api/internal/logic/platform/resource.go`
+- Create: `backend/api/internal/logic/platform/resource_test.go`
+- Create: `backend/api/internal/routers/platform_test.go`
+- Modify: `frontend/platform_admin/scripts/audit-check.mjs`
+- Modify: `frontend/platform_admin/package.json`
+
+**Interfaces:** `ExpectedResources() []ResourceContract` 返回领域、资源名、读写模式和页面类型；`pnpm audit:platform` 缺层时输出 `domain/name: missing <layer>`。
+
+- [ ] **Step 1: 写失败的资源契约测试。**
+
+```go
+func TestExpectedResources(t *testing.T) {
+    assertContract(t, ExpectedResources(), "gas", "gas_basic", Writable, "list")
+    assertContract(t, ExpectedResources(), "device", "saf_event", Writable, "list")
+    assertContract(t, ExpectedResources(), "wallet", "wallet_ledger", ReadOnly, "list")
+}
+```
+
+- [ ] **Step 2: 运行失败测试。**
+
+Run: `go test ./internal/logic/platform ./internal/routers -run TestExpectedResources -v`
+
+Expected: FAIL，提示 `ExpectedResources`、`ResourceContract` 或资源模式尚未定义。
+
+- [ ] **Step 3: 实现完整资源清单和审计命令。**
+
+```go
+type ResourceMode string
+const ( Writable ResourceMode = "writable"; ReadOnly ResourceMode = "readonly" )
+type ResourceContract struct { Domain, Name, PageKind string; Mode ResourceMode }
+func ExpectedResources() []ResourceContract { return []ResourceContract{{"gas", "gas_basic", "list", Writable}} }
+```
+
+将完整 `Resource Contract` 清单写入函数和 JSON 可读清单；脚本核对 `resources.ts`、路由模块及页面路径。
+
+- [ ] **Step 4: 运行资源测试和审计命令。**
+
+Run: `go test ./internal/logic/platform ./internal/routers -run TestExpectedResources -v; pnpm audit:platform`
+
+Expected: 测试 PASS；审计命令列出当前缺失层，作为后续任务的失败清单。
+
+- [ ] **Step 5: 提交基线。**
+
+```powershell
+git add backend/api/internal/logic/platform/resource.go backend/api/internal/logic/platform/resource_test.go backend/api/internal/routers/platform_test.go frontend/platform_admin/scripts/audit-check.mjs frontend/platform_admin/package.json
+git commit -m "test: add platform resource contract audit"
+```
+
+### Task 2: 修订模型和通用后端资源处理器
+
+**Files:**
+- Modify: `backend/api/internal/logic/platform/platform.go`
+- Modify: `backend/api/internal/logic/platform/resource.go`
+- Modify: `backend/api/internal/models/entity.go`
+- Modify: `backend/api/internal/models/*.go`
+- Test: `backend/api/internal/logic/platform/resource_test.go`
+
+**Interfaces:** `ResourceDefinition{Domain, Name, Model, Mode, CreateFields, UpdateFields}`；`RegisterResource(*gin.RouterGroup, ResourceDefinition)`；通用列表、详情、创建、更新、状态和归档处理器。
+
+- [ ] **Step 1: 写失败的只读、字段白名单和归档测试。**
+
+```go
+func TestReadOnlyResourceRejectsWrite(t *testing.T) {
+    if (ResourceDefinition{Mode: ReadOnly}).Allows(http.MethodPost) { t.Fatal("readonly POST") }
+}
+func TestArchiveUsesStatus(t *testing.T) {
+    if archiveValues()["status"] != "archived" { t.Fatal("must archive") }
+}
+```
+
+- [ ] **Step 2: 运行失败测试。**
+
+Run: `go test ./internal/logic/platform -run 'Test(ReadOnly|Archive)' -v`
+
+Expected: FAIL，因为 `Allows` 和 `archiveValues` 不存在。
+
+- [ ] **Step 3: 实现最小通用处理器和模型审计。**
+
+```go
+func (d ResourceDefinition) Allows(method string) bool { return d.Mode == Writable || method == http.MethodGet }
+func archiveValues() gin.H { return gin.H{"status": "archived"} }
+```
+
+逐模型核对 `Entity`、业务编码唯一索引、关联字段和中文注释。仅当字段不在需求、无 GORM 关联或索引、无 HTTP 和前端消费者时才删除，并将理由写入最终报告。
+
+- [ ] **Step 4: 验证通用层。**
+
+Run: `gofmt -w internal/logic/platform internal/models; go test ./...; go build ./cmd/main`
+
+Expected: PASS。
+
+- [ ] **Step 5: 提交通用层。**
+
+```powershell
+git add backend/api/internal/logic/platform backend/api/internal/models
+git commit -m "feat: add audited platform resource foundation"
+```
+
+### Task 3: 完成组织、账户、人员和用户领域
+
+**Files:**
+- Create: `backend/api/internal/logic/platform/organization.go`
+- Modify: `backend/api/internal/logic/platform/{gas,delivery,staff,user,role}.go`
+- Modify: `backend/api/internal/routers/platform.go`
+- Test: `backend/api/internal/logic/platform/organization_test.go`
+
+**Interfaces:** 注册 `/gas/gas_basic`、`/gas/gas_account`、`/delivery/delivery_basic`、`/delivery/delivery_account`、`/staff/account`、`/staff/credential`、`/user/account`、`/user/address`、`/user/service_relation`、`/platform/platfrom_account`、`/platform/platform_role`、`/platform/platform_menu`。
+
+- [ ] **Step 1: 写失败的名称和角色保护测试。**
+
+```go
+func TestOrganizationRoutesKeepGasBasic(t *testing.T) { assertRoute(t, routes, http.MethodGet, "/gas/gas_basic") }
+func TestSystemRoleCannotMutate(t *testing.T) { if mayMutateRole(models.PlatformRole{IsSystem: true}) { t.Fatal("system role") } }
+func TestAccountMasksPhone(t *testing.T) { if maskPhone("13812345678") != "138****5678" { t.Fatal("mask") } }
+```
+
+- [ ] **Step 2: 运行失败测试。**
+
+Run: `go test ./internal/logic/platform ./internal/routers -run 'Test(Organization|SystemRole|Account)' -v`
+
+Expected: FAIL，直至路由、系统角色保护和账户视图完成。
+
+- [ ] **Step 3: 实现领域资源和专用动作。**
+
+账户创建及角色菜单覆盖使用事务；更新只接受字段白名单；系统角色拒绝更新、状态变更与归档；平台账户只返回脱敏电话和非密码字段。
+
+- [ ] **Step 4: 验证领域。**
+
+Run: `go test ./internal/logic/platform ./internal/routers -v; go build ./cmd/main`
+
+Expected: PASS。
+
+- [ ] **Step 5: 提交领域。**
+
+```powershell
+git add backend/api/internal/logic/platform backend/api/internal/routers/platform.go
+git commit -m "feat: complete organization account APIs"
+```
+
+### Task 4: 完成设备管理、电商和配送领域
+
+**Files:**
+- Create: `backend/api/internal/logic/platform/{device,commerce}.go`
+- Modify: `backend/api/internal/logic/platform/delivery.go`
+- Modify: `backend/api/internal/routers/platform.go`
+- Test: `backend/api/internal/logic/platform/{device,commerce}_test.go`
+
+**Interfaces:** 注册 `/device/*`、`/safety/*`、`/ec/*`、`/delivery/delivery_task`、`/delivery/delivery_track` 和 `/delivery/delivery_track_point`。
+
+- [ ] **Step 1: 写失败的安全和订单轨迹测试。**
+
+```go
+func TestDeviceManagementIncludesSafety(t *testing.T) { assertContract(t, ExpectedResources(), "safety", "saf_event", Writable, "list") }
+func TestSafetyDisposalIsAppendOnly(t *testing.T) { if disposalDefinition.Allows(http.MethodDelete) { t.Fatal("disposal delete") } }
+func TestTrackPointRoute(t *testing.T) { assertRoute(t, routes, http.MethodPost, "/delivery/delivery_track_point") }
+```
+
+- [ ] **Step 2: 运行失败测试。**
+
+Run: `go test ./internal/logic/platform ./internal/routers -run 'Test(Device|Safety|Track)' -v`
+
+Expected: FAIL，直至领域资源与事件动作完成。
+
+- [ ] **Step 3: 实现资源。**
+
+设备、绑定、规则、事件和安检采用可写资源，遥测只读；事件处置在事务中更新事件并追加含 `operator_identity`、`action`、`reason` 的记录。商品、属性、图片、购物车、订单、订单项、评论、配送任务、轨迹和轨迹点全部注册；订单详情包含订单项，轨迹详情按时间包含轨迹点。
+
+- [ ] **Step 4: 验证领域。**
+
+Run: `go test ./...; go build ./cmd/main`
+
+Expected: PASS。
+
+- [ ] **Step 5: 提交领域。**
+
+```powershell
+git add backend/api/internal/logic/platform backend/api/internal/routers/platform.go
+git commit -m "feat: complete device commerce delivery APIs"
+```
+
+### Task 5: 完成财务、钱包、报表、内容和审计领域
+
+**Files:**
+- Create: `backend/api/internal/logic/platform/{finance,content,audit}.go`
+- Modify: `backend/api/internal/logic/platform/health.go`
+- Modify: `backend/api/internal/models/query.go`
+- Modify: `backend/api/internal/routers/platform.go`
+- Test: `backend/api/internal/logic/platform/{finance,content,audit}_test.go`
+
+**Interfaces:** 注册 `/finance/*`、`/wallet/*`、`/report/*`、`/content/*`、`/customer_service/*`、`/audit/*` 与扩展的 `/dashboard/overview`。
+
+- [ ] **Step 1: 写失败的只读与审批审计测试。**
+
+```go
+func TestWalletAndReportAreReadOnly(t *testing.T) { assertNoRoute(t, routes, http.MethodPost, "/wallet/wallet") }
+func TestApprovalStoresOperator(t *testing.T) { if approvalValues("approved", "op-1")["operator_identity"] != "op-1" { t.Fatal("operator") } }
+```
+
+- [ ] **Step 2: 运行失败测试。**
+
+Run: `go test ./internal/logic/platform ./internal/routers -run 'Test(Wallet|Approval)' -v`
+
+Expected: FAIL，直至只读路由和审批动作存在。
+
+- [ ] **Step 3: 实现资源和看板聚合。**
+
+支付、结算、对账、内容、模板和工单可写；钱包、资金流水、充值、提现、报表、指标快照与审计仅注册 GET。审批仅更新状态、意见、处理人和时间，并追加操作审计；空数据看板返回零值。
+
+- [ ] **Step 4: 验证领域。**
+
+Run: `go test ./...; go build ./cmd/main`
+
+Expected: PASS。
+
+- [ ] **Step 5: 提交领域。**
+
+```powershell
+git add backend/api/internal/logic/platform backend/api/internal/models/query.go backend/api/internal/routers/platform.go
+git commit -m "feat: complete finance content audit APIs"
+```
+
+### Task 6: 建立前端资源契约并补齐页面
+
+**Files:**
+- Create: `frontend/platform_admin/src/api/resources.ts`
+- Create: `frontend/platform_admin/src/views/shared/{ReadOnlyListPage,TreePage}.vue`
+- Create: `frontend/platform_admin/src/views/{gas,delivery,staff,user,device,ec,finance,wallet,report,content,audit}/**/ListPage.vue`
+- Modify: `frontend/platform_admin/src/views/shared/CrudListPage.vue`
+- Modify: `frontend/platform_admin/src/api/{resource,platform,gas,delivery,staff,user}.ts`
+- Modify: `frontend/platform_admin/src/router/routes/modules/platform.ts`
+- Test: `frontend/platform_admin/scripts/audit-check.mjs`
+
+**Interfaces:** `ResourceUiDefinition { key, resource, title, mode, pageKind, fields }`；每个后端契约对应一个前端资源、菜单路由和页面。
+
+- [ ] **Step 1: 写失败的前端资源断言。**
+
+```js
+assertResource(resources, { key: 'gas-basic', resource: '/gas/gas_basic', mode: 'writable', pageKind: 'list' });
+assertResource(resources, { key: 'wallet-ledger', resource: '/wallet/wallet_ledger', mode: 'readonly', pageKind: 'list' });
+assertRouteFile('src/views/device/safety-event/ListPage.vue');
+```
+
+- [ ] **Step 2: 运行失败断言。**
+
+Run: `pnpm audit:platform`
+
+Expected: FAIL，列出缺失资源、页面或菜单路由。
+
+- [ ] **Step 3: 实现资源声明、共享组件和页面。**
+
+```ts
+export type ResourceUiDefinition = { key: string; resource: string; title: string; mode: 'writable' | 'readonly'; pageKind: 'list' | 'tree' | 'dashboard'; fields: Array<{ key: string; label: string; required?: boolean }> };
+export const resources: ResourceUiDefinition[] = [{ key: 'gas-basic', resource: '/gas/gas_basic', title: '气站管理', mode: 'writable', pageKind: 'list', fields: [{ key: 'code', label: '气站编码', required: true }, { key: 'name', label: '气站名称', required: true }] }];
+```
+
+`CrudListPage` 增加详情请求、归档二次确认、服务端筛选和类型化字段；`ReadOnlyListPage` 不渲染写操作；`TreePage` 支持父子节点、新增、编辑、排序和归档。每个页面只传资源声明，禁止复制 HTTP 调用。
+
+- [ ] **Step 4: 验证前端。**
+
+Run: `pnpm type:check; pnpm audit:platform; pnpm build`
+
+Expected: PASS，且审计报告每个契约都有页面和菜单路由。
+
+- [ ] **Step 5: 提交前端。**
+
+```powershell
+git add frontend/platform_admin/src frontend/platform_admin/scripts/audit-check.mjs frontend/platform_admin/package.json
+git commit -m "feat: complete platform administration pages"
+```
+
+### Task 7: 全量映射、冗余清理和最终验收
+
+**Files:**
+- Modify: `backend/api/internal/logic/platform/*`
+- Modify: `backend/api/internal/models/*`
+- Modify: `backend/api/internal/routers/platform.go`
+- Modify: `frontend/platform_admin/src/{api,router,views}/**/*`
+- Modify: `frontend/platform_admin/scripts/audit-check.mjs`
+- Create: `docs/平台总后台审计报告-2026-07-27.md`
+
+**Interfaces:** 完整资源清单、后端注册路由、前端资源、页面与菜单必须一一对应。
+
+- [ ] **Step 1: 写失败的全量映射测试。**
+
+```go
+func TestEveryContractHasRegisteredRoute(t *testing.T) {
+    for _, contract := range ExpectedResources() { assertResourceRoutes(t, registeredRoutes, contract) }
+}
+```
+
+```js
+for (const contract of expectedContracts) { assertBackendRoute(contract); assertFrontendResource(contract); assertPage(contract); assertMenuRoute(contract); }
+```
+
+- [ ] **Step 2: 运行全量映射测试。**
+
+Run: `go test ./...; pnpm audit:platform`
+
+Expected: 任一遗漏失败为 `domain/name: missing <layer>`。
+
+- [ ] **Step 3: 修复遗漏并清理可证明冗余。**
+
+仅删除同时满足“不在需求、无后端调用、无前端消费者、无测试或迁移依赖”的代码或字段；对保留的快照、审计和授权字段在报告说明用途。
+
+- [ ] **Step 4: 运行最终验证。**
+
+Run: `go test ./...; go build ./cmd/main; pnpm type:check; pnpm lint; pnpm audit:platform; pnpm build`
+
+Expected: 全部 PASS，报告记录命令退出码及资源数量。
+
+- [ ] **Step 5: 提交最终修复和审计报告。**
+
+```powershell
+git add backend/api frontend/platform_admin docs/平台总后台审计报告-2026-07-27.md
+git commit -m "fix: complete platform admin audit remediation"
+```
+
+## Plan Self-Review
+
+- 需求覆盖：Task 2 审计模型与基础语义；Task 3 至 5 覆盖所有后端领域；Task 6 覆盖菜单、路由和页面；Task 7 验证端到端映射并产出审计报告。
+- 命名一致：后端和前端共享同一资源契约，气站唯一资源为 `/gas/gas_basic`。
+- 非目标：不实现需求明确后置的双人复核、资金审批、敏感导出审批和精确轨迹回放；保留相关模型和扩展边界。
+- 无占位项：资源、路径、命令、测试与提交范围均已给出。