feat(ECR-012–016): 合规、题库、时辰刷新、头像、MBTI OEJTS 与埋点

落地输入合规、探索题库、报告日/时辰刷新、账号头像、OEJTS 量表，并补齐 H5 埋点与 Admin 漏斗；同步 ESS 工件、切至自建 Git、清理 GitHub Actions。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/handler/auth.go

@@ -24,6 +24,7 @@ func (h *AuthHandler) Register(api *gin.RouterGroup) {
 	g.POST("/logout", h.Logout)
 	g.GET("/me", h.Me)
 	g.PATCH("/me", h.PatchMe)
+	g.POST("/me/avatar", h.UploadAvatar)
 }
 
 type authBody struct {
@@ -47,6 +48,9 @@ func (h *AuthHandler) RegisterAccount(c *gin.Context) {
 	deviceKey := c.GetHeader(middleware.DeviceKeyHeader)
 	res, err := h.Svc.Register(c.Request.Context(), userID, deviceKey, body.Phone, body.Password, body.Nickname)
 	if err != nil {
+		if failTextCompliance(c, err) {
+			return
+		}
 		response.Fail(c, http.StatusBadRequest, 40110, err.Error())
 		return
 	}
@@ -116,12 +120,35 @@ func (h *AuthHandler) PatchMe(c *gin.Context) {
 	}
 	me, err := h.Svc.UpdateNickname(c.Request.Context(), userID, body.Nickname)
 	if err != nil {
+		if failTextCompliance(c, err) {
+			return
+		}
 		response.Fail(c, http.StatusBadRequest, 40113, err.Error())
 		return
 	}
 	response.OK(c, me)
 }
 
+// UploadAvatar handles POST /auth/me/avatar (multipart file).
+func (h *AuthHandler) UploadAvatar(c *gin.Context) {
+	userID, ok := middleware.UserIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40100, "unauthorized")
+		return
+	}
+	fh, err := c.FormFile("file")
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 10000, "请选择图片")
+		return
+	}
+	me, err := h.Svc.UpdateAvatar(c.Request.Context(), userID, fh)
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40114, err.Error())
+		return
+	}
+	response.OK(c, me)
+}
+
 func bearerToken(c *gin.Context) string {
 	h := c.GetHeader("Authorization")
 	if strings.HasPrefix(strings.ToLower(h), "bearer ") {