feat(api): 接入微信登录并原生实现咨询域（ECR-049/050）

小程序可在 Go 上完成微信手机号登录、测评、预约和下单，不再反代 Java。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/handler/auth.go

@@ -22,6 +22,7 @@ func (h *AuthHandler) Register(api *gin.RouterGroup) {
 	g := api.Group("/auth")
 	g.POST("/register", h.RegisterAccount)
 	g.POST("/login", h.Login)
+	g.POST("/wechat", h.WeChat)
 	g.POST("/logout", h.Logout)
 	g.GET("/me", h.Me)
 	g.PATCH("/me", h.PatchMe)
@@ -34,6 +35,12 @@ type authBody struct {
 	Nickname string `json:"nickname"`
 }
 
+type wechatBody struct {
+	Code          string `json:"code"`
+	EncryptedData string `json:"encryptedData"`
+	IV            string `json:"iv"`
+}
+
 // RegisterAccount handles POST /auth/register (DeviceAuth required on group).
 func (h *AuthHandler) RegisterAccount(c *gin.Context) {
 	userID, ok := middleware.UserIDFromContext(c)
@@ -88,6 +95,32 @@ func (h *AuthHandler) Login(c *gin.Context) {
 	response.OK(c, res)
 }
 
+// WeChat handles POST /auth/wechat (mini-program phone login).
+func (h *AuthHandler) WeChat(c *gin.Context) {
+	userID, ok := middleware.UserIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40100, "unauthorized")
+		return
+	}
+	var body wechatBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.Fail(c, http.StatusBadRequest, 10000, "invalid request")
+		return
+	}
+	deviceKey := c.GetHeader(middleware.DeviceKeyHeader)
+	res, err := h.Svc.WeChatLogin(c.Request.Context(), userID, deviceKey, body.Code, body.EncryptedData, body.IV)
+	if err != nil {
+		if errors.Is(err, auth.ErrAccountRestricted) {
+			response.Fail(c, http.StatusUnauthorized, 40113, err.Error())
+			return
+		}
+		response.Fail(c, http.StatusBadRequest, 40115, err.Error())
+		return
+	}
+	c.Set(string(middleware.UserIDKey), res.User.ID)
+	response.OK(c, res)
+}
+
 // Logout handles POST /auth/logout.
 func (h *AuthHandler) Logout(c *gin.Context) {
 	tok := bearerToken(c)