feat: 完成模拟交易闭环、App 与 A 股行情接入

统一单入口 Go 工程与前端依赖目录，增加后台供应商配置、候选审核、计划预算、成交冲正、持仓复盘和站内通知。接入策略版本、Python 回测、可配置 A 股公开行情及 zap 文件轮转日志，补充迁移、契约与验证。

internal/handler/candidate.go

@@ -0,0 +1,99 @@
+package handler
+
+import (
+	"git.sundynix.cn/Blizzard/Veyra/internal/apperror"
+	"git.sundynix.cn/Blizzard/Veyra/internal/model"
+	"github.com/gin-gonic/gin"
+	"net/http"
+	"strconv"
+)
+
+func bindCandidates(r *gin.Engine, options IdentityOptions) {
+	for _, admin := range []bool{true, false} {
+		path, audience := "/api/v1", "app"
+		if admin {
+			path, audience = "/api/admin/v1", "admin"
+		}
+		group := r.Group(path, func(c *gin.Context) { authenticate(c, options, audience) })
+		group.Use(func(c *gin.Context) {
+			if options.Candidates == nil {
+				fail(c, apperror.ErrUnavailable)
+				return
+			}
+			c.Next()
+		})
+		group.GET("/candidates", func(c *gin.Context) {
+			limit := 100
+			if raw := c.Query("limit"); raw != "" {
+				value, err := strconv.Atoi(raw)
+				if err != nil {
+					fail(c, apperror.ErrInvalidInput)
+					return
+				}
+				limit = value
+			}
+			result, err := options.Candidates.List(c.Request.Context(), currentUser(c), admin, c.Query("status"), limit)
+			if err != nil {
+				fail(c, err)
+				return
+			}
+			success(c, http.StatusOK, result)
+		})
+		group.GET("/candidates/:id", func(c *gin.Context) {
+			result, err := options.Candidates.Detail(c.Request.Context(), currentUser(c), c.Param("id"), admin)
+			if err != nil {
+				fail(c, err)
+				return
+			}
+			success(c, http.StatusOK, result)
+		})
+		if !admin {
+			continue
+		}
+		group.Use(func(c *gin.Context) {
+			if !sameOrigin(c.Request) {
+				fail(c, apperror.ErrForbidden)
+				return
+			}
+			c.Next()
+		})
+		group.POST("/candidates", func(c *gin.Context) {
+			var input model.CandidateDraftInput
+			if !decode(c, &input) {
+				return
+			}
+			result, err := options.Candidates.Create(c.Request.Context(), currentUser(c), "", c.Writer.Header().Get("X-Request-ID"), input, 0)
+			if err != nil {
+				fail(c, err)
+				return
+			}
+			success(c, http.StatusCreated, result)
+		})
+		group.POST("/candidates/:id/revisions", func(c *gin.Context) {
+			var input model.CandidateRevisionInput
+			if !decode(c, &input) {
+				return
+			}
+			result, err := options.Candidates.Create(c.Request.Context(), currentUser(c), c.Param("id"), c.Writer.Header().Get("X-Request-ID"), input.CandidateDraftInput, input.ExpectedVersion)
+			if err != nil {
+				fail(c, err)
+				return
+			}
+			success(c, http.StatusCreated, result)
+		})
+		for endpoint, action := range map[string]string{"submit": "SUBMIT", "publish": "PUBLISH", "return": "RETURN", "withdraw": "WITHDRAW"} {
+			group.POST("/candidates/:id/"+endpoint, func(c *gin.Context) {
+				var input model.CandidateActionInput
+				if !decode(c, &input) {
+					return
+				}
+				result, err := options.Candidates.Transition(c.Request.Context(), currentUser(c), c.Param("id"), action, c.Writer.Header().Get("X-Request-ID"), input)
+				if err != nil {
+					fail(c, err)
+					return
+				}
+				success(c, http.StatusOK, result)
+			})
+		}
+	}
+}