feat(ops): ECR-007 行为分析与 ECR-008 内容运营后台

落地埋点 ingest/数据看板、首页宫格 CMS 与测评上下架；含账号引导、问答流式与免责声明去重，以及 review P1 审计同事务修复。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/integration/p2_flows_test.go

@@ -22,6 +22,9 @@ func doJSONExpect(t *testing.T, r http.Handler, method, path string, body any, d
 	if deviceKey != "" {
 		req.Header.Set("X-Device-Key", deviceKey)
 	}
+	if testBearer != "" {
+		req.Header.Set("Authorization", "Bearer "+testBearer)
+	}
 	w := httptest.NewRecorder()
 	r.ServeHTTP(w, req)
 	if w.Code >= 500 {
@@ -61,7 +64,8 @@ func createSelfProfile(t *testing.T, r http.Handler, birth, key string) (profile
 // Flow: star report → gated detail → mock deep unlock
 func TestFlowStarDeepAccess(t *testing.T) {
 	r, _ := setupAPI(t)
-	pid, key := createSelfProfile(t, r, "1983-06-06", "")
+	key := mustRegister(t, r)
+	pid, key := createSelfProfile(t, r, "1983-06-06", key)
 
 	env, key := doJSON(t, r, http.MethodPost, "/api/v1/reports/star", map[string]any{
 		"profile_id": pid,
@@ -106,7 +110,8 @@ func TestFlowStarDeepAccess(t *testing.T) {
 // Flow: rhythm report gated + unlock
 func TestFlowRhythmDeepAccess(t *testing.T) {
 	r, _ := setupAPI(t)
-	pid, key := createSelfProfile(t, r, "1992-06-08", "")
+	key := mustRegister(t, r)
+	pid, key := createSelfProfile(t, r, "1992-06-08", key)
 
 	env, key := doJSON(t, r, http.MethodPost, "/api/v1/reports/rhythm", map[string]any{
 		"profile_id": pid,
@@ -140,7 +145,8 @@ func TestFlowRhythmDeepAccess(t *testing.T) {
 // Flow: image card scenes → draw → quota exhaust → depth unlock via mock pay
 func TestFlowImageCardQuotaAndDepth(t *testing.T) {
 	r, _ := setupAPI(t)
-	pid, key := createSelfProfile(t, r, "1990-01-01", "")
+	key := mustRegister(t, r)
+	pid, key := createSelfProfile(t, r, "1990-01-01", key)
 
 	env, key := doJSON(t, r, http.MethodGet, "/api/v1/image-cards/scenes", nil, key)
 	scenes := decodeData[map[string]any](t, env.Data)
@@ -199,7 +205,7 @@ func TestFlowImageCardQuotaAndDepth(t *testing.T) {
 // Flow: solar terms + mood save/read
 func TestFlowCompanionMood(t *testing.T) {
 	r, _ := setupAPI(t)
-	var key string
+	key := mustRegister(t, r)
 
 	env, key := doJSON(t, r, http.MethodGet, "/api/v1/solar-terms/today", nil, key)
 	term := decodeData[map[string]any](t, env.Data)