feat(ECR-015): RedemptionCode 兑换码并 Closed

批次生成/作废、C 端兑码延长会员；admin-h5 /codes。
Loop continuous。Next：ECR-016 UserIntelligence。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/handler/report.go

@@ -37,6 +37,7 @@ func (h *ReportHandler) Register(rg *gin.RouterGroup) {
 	rg.GET("/reports/latest", h.GetLatest)
 	rg.GET("/reports/:id", h.Get)
 	rg.GET("/membership/me", h.GetMembership)
+	rg.POST("/membership/redeem", h.RedeemCode)
 	rg.POST("/orders", h.CreateOrder)
 	rg.POST("/orders/:id/pay-mock", h.PayMock)
 }
@@ -257,6 +258,37 @@ func (h *ReportHandler) GetMembership(c *gin.Context) {
 	response.OK(c, me)
 }
 
+// RedeemCode handles POST /membership/redeem.
+func (h *ReportHandler) RedeemCode(c *gin.Context) {
+	userID, ok := middleware.UserIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40100, "unauthorized")
+		return
+	}
+	msvc, ok := h.requireMembership(c)
+	if !ok {
+		return
+	}
+	var body struct {
+		Code string `json:"code"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil || body.Code == "" {
+		response.Fail(c, http.StatusBadRequest, 40000, "code required")
+		return
+	}
+	plan, err := msvc.Redeem(c.Request.Context(), userID, body.Code)
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40000, err.Error())
+		return
+	}
+	me, err := msvc.Get(c.Request.Context(), userID)
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50000, err.Error())
+		return
+	}
+	response.OK(c, gin.H{"plan": plan, "membership": me})
+}
+
 // CreateOrder handles POST /orders.
 func (h *ReportHandler) CreateOrder(c *gin.Context) {
 	userID, ok := middleware.UserIDFromContext(c)