feat(ops): ECR-007 行为分析与 ECR-008 内容运营后台

落地埋点 ingest/数据看板、首页宫格 CMS 与测评上下架；含账号引导、问答流式与免责声明去重，以及 review P1 审计同事务修复。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/handler/auth.go

@@ -0,0 +1,105 @@
+package handler
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/middleware"
+	"github.com/yuxingu/digital-psychology/apps/api/internal/service/auth"
+	"github.com/yuxingu/digital-psychology/apps/api/pkg/response"
+)
+
+// AuthHandler serves /api/v1/auth/*.
+type AuthHandler struct {
+	Svc *auth.Service
+}
+
+// Register mounts auth routes. Public register/login; me/logout need device (+ session).
+func (h *AuthHandler) Register(api *gin.RouterGroup) {
+	g := api.Group("/auth")
+	g.POST("/register", h.RegisterAccount)
+	g.POST("/login", h.Login)
+	g.POST("/logout", h.Logout)
+	g.GET("/me", h.Me)
+}
+
+type authBody struct {
+	Phone    string `json:"phone"`
+	Password string `json:"password"`
+	Nickname string `json:"nickname"`
+}
+
+// RegisterAccount handles POST /auth/register (DeviceAuth required on group).
+func (h *AuthHandler) RegisterAccount(c *gin.Context) {
+	userID, ok := middleware.UserIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40100, "unauthorized")
+		return
+	}
+	var body authBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.Fail(c, http.StatusBadRequest, 10000, "invalid request")
+		return
+	}
+	deviceKey := c.GetHeader(middleware.DeviceKeyHeader)
+	res, err := h.Svc.Register(c.Request.Context(), userID, deviceKey, body.Phone, body.Password, body.Nickname)
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40110, err.Error())
+		return
+	}
+	response.OK(c, res)
+}
+
+// Login handles POST /auth/login (open mode: any phone+password).
+func (h *AuthHandler) Login(c *gin.Context) {
+	userID, ok := middleware.UserIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40100, "unauthorized")
+		return
+	}
+	var body authBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.Fail(c, http.StatusBadRequest, 10000, "invalid request")
+		return
+	}
+	deviceKey := c.GetHeader(middleware.DeviceKeyHeader)
+	res, err := h.Svc.Login(c.Request.Context(), userID, deviceKey, body.Phone, body.Password)
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40111, err.Error())
+		return
+	}
+	c.Set(string(middleware.UserIDKey), res.User.ID)
+	response.OK(c, res)
+}
+
+// Logout handles POST /auth/logout.
+func (h *AuthHandler) Logout(c *gin.Context) {
+	tok := bearerToken(c)
+	_ = h.Svc.Logout(c.Request.Context(), tok)
+	response.OK(c, gin.H{"ok": true})
+}
+
+// Me handles GET /auth/me.
+func (h *AuthHandler) Me(c *gin.Context) {
+	userID, ok := middleware.UserIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40100, "unauthorized")
+		return
+	}
+	me, err := h.Svc.Me(c.Request.Context(), userID)
+	if err != nil {
+		response.Fail(c, http.StatusUnauthorized, 40112, "请先登录")
+		return
+	}
+	response.OK(c, me)
+}
+
+func bearerToken(c *gin.Context) string {
+	h := c.GetHeader("Authorization")
+	if strings.HasPrefix(strings.ToLower(h), "bearer ") {
+		return strings.TrimSpace(h[7:])
+	}
+	return ""
+}