feat: add WeChat Pay, Redis logging, storage tiers and personal albums

Replace virtual payments with WeChat Pay API v3 and verify callbacks and order polling. Cache WeChat access tokens in Redis and write structured Zap logs. Support configurable capacity plans across the API, admin and mini program, with purchase snapshots and quota enforcement. Allow personal albums before binding and share them with the current partner. Update deployment configuration and domain routing.

deploy/linux/nginx-past.conf

@@ -1,18 +1,46 @@
-# 宝塔网站 → 设置 → 配置文件，把下面整段放到 server { } 内（或改用宝塔“反向代理”UI）
-# 作用：把域名的所有请求反代到本地 Go 后端（:8080），由宝塔 Nginx 负责 HTTPS/SSL。
+# Insert into the existing we.sundynix.cn HTTPS server block.
+# Keep the existing SSL and ACME configuration. Replace matching locations.
+location = / {
+    return 302 /backend/admin/login;
+}
 
-# 允许大文件上传（与 config.yaml 的 max_upload_mb 保持一致，默认 50MB）
-client_max_body_size 50m;
-
-location / {
-    proxy_pass http://127.0.0.1:8080;
-    proxy_http_version 1.1;
+location = /api {
+    client_max_body_size 60m;
+    proxy_read_timeout 180s;
+    proxy_send_timeout 180s;
+    proxy_pass http://127.0.0.1:8081;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
-    # 大文件/慢请求超时，与后端 ReadTimeout 对应
-    proxy_connect_timeout 60s;
+}
+location ^~ /api/ {
+    client_max_body_size 60m;
     proxy_read_timeout 180s;
     proxy_send_timeout 180s;
+    proxy_pass http://127.0.0.1:8081;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
+location ^~ /backend/ {
+    client_max_body_size 60m;
+    proxy_read_timeout 180s;
+    proxy_send_timeout 180s;
+    proxy_pass http://127.0.0.1:8081;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
+location = /healthz {
+    client_max_body_size 60m;
+    proxy_read_timeout 180s;
+    proxy_send_timeout 180s;
+    proxy_pass http://127.0.0.1:8081;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
 }

deploy/linux/past.service

@@ -1,19 +1,21 @@
 [Unit]
-Description=past-go backend service
-After=network.target mysql.service
-Wants=mysql.service
+Description=Past Go API
+After=network-online.target postgresql.service redis-server.service
+Wants=network-online.target
+Requires=postgresql.service redis-server.service
 
 [Service]
 Type=simple
-# 运行用户：宝塔默认站点用户为 www，需对该用户有 data_dir/uploads 写权限
 User=www
 Group=www
-# 改为你实际上传二进制与 config.yaml 的目录
-WorkingDirectory=/www/wwwroot/past
-ExecStart=/www/wwwroot/past/past-server -config /www/wwwroot/past/config.yaml
-Restart=always
+WorkingDirectory=/home/workspace
+ExecStart=/home/workspace/past-server -config /home/workspace/config.yaml
+Environment=TZ=Asia/Shanghai
+Restart=on-failure
 RestartSec=3
-# 标准输出/错误会进 journalctl；程序自身也会写 data/go-server.log
+UMask=0077
+NoNewPrivileges=true
+PrivateTmp=true
 StandardOutput=journal
 StandardError=journal