feat(ECR-041): OpsCMS Banner 薄写面（Write-Wave 首刀）

Admin POST/PUT + admin.cms.write/审计；C 端 GET /home/banners；首页投影回退静态 homeFeeds；migration 000051；不碰 FeedSlot/支付/UGC。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/handler/admin_cms.go

@@ -16,6 +16,8 @@ func (h *AdminHandler) registerCMS(authed *gin.RouterGroup) {
 	g := authed.Group("/cms")
 	g.GET("/banners", middleware.RequireAdminPermission(h.Svc, admin.PermCMSRead), h.ListBanners)
 	g.GET("/banners/:id", middleware.RequireAdminPermission(h.Svc, admin.PermCMSRead), h.GetBanner)
+	g.POST("/banners", middleware.RequireAdminPermission(h.Svc, admin.PermCMSWrite), h.CreateBanner)
+	g.PUT("/banners/:id", middleware.RequireAdminPermission(h.Svc, admin.PermCMSWrite), h.UpdateBanner)
 	g.GET("/feed-slots", middleware.RequireAdminPermission(h.Svc, admin.PermCMSRead), h.ListFeedSlots)
 	g.GET("/feed-slots/:id", middleware.RequireAdminPermission(h.Svc, admin.PermCMSRead), h.GetFeedSlot)
 }
@@ -47,6 +49,69 @@ func (h *AdminHandler) GetBanner(c *gin.Context) {
 	response.OK(c, row)
 }
 
+func (h *AdminHandler) CreateBanner(c *gin.Context) {
+	adminID, ok := middleware.AdminIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40101, "admin auth required")
+		return
+	}
+	var body admin.BannerWriteBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.Fail(c, http.StatusBadRequest, 40050, "invalid body")
+		return
+	}
+	row, err := h.Svc.CreateBanner(c.Request.Context(), adminID, body)
+	if errors.Is(err, admin.ErrInvalidBanner) {
+		response.Fail(c, http.StatusBadRequest, 40051, "invalid banner")
+		return
+	}
+	if errors.Is(err, admin.ErrBannerConflict) {
+		response.Fail(c, http.StatusConflict, 40910, "banner code conflict")
+		return
+	}
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50044, "create banner failed")
+		return
+	}
+	response.OK(c, row)
+}
+
+func (h *AdminHandler) UpdateBanner(c *gin.Context) {
+	adminID, ok := middleware.AdminIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40101, "admin auth required")
+		return
+	}
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40002, "invalid id")
+		return
+	}
+	var body admin.BannerWriteBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.Fail(c, http.StatusBadRequest, 40050, "invalid body")
+		return
+	}
+	row, err := h.Svc.UpdateBanner(c.Request.Context(), adminID, id, body)
+	if errors.Is(err, admin.ErrBannerNotFound) {
+		response.Fail(c, http.StatusNotFound, 40410, "banner not found")
+		return
+	}
+	if errors.Is(err, admin.ErrInvalidBanner) {
+		response.Fail(c, http.StatusBadRequest, 40051, "invalid banner")
+		return
+	}
+	if errors.Is(err, admin.ErrBannerConflict) {
+		response.Fail(c, http.StatusConflict, 40910, "banner code conflict")
+		return
+	}
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50045, "update banner failed")
+		return
+	}
+	response.OK(c, row)
+}
+
 func (h *AdminHandler) ListFeedSlots(c *gin.Context) {
 	items, err := h.Svc.ListFeedSlots(c.Request.Context())
 	if err != nil {