init: 后端框架脚手架 (Go + Gin + GORM + MySQL)

- 项目目录结构：backend/ deploy/ schema/ migrations/
- 数据库 Schema：所有建表 SQL，含 hotel_id 多租户隔离
- Go 后端：config、model、handler、service、middleware、router
- 认证：账号密码登录 + JWT（Access + Refresh Token）
- 许可证：HMAC-SHA256 激活码生成 + 设备绑定验证
- 业务模块：商品、仓库、往来单位、入库、出库、库存、盘点
- 库存事务：入库/出库审核时原子更新库存 + 流水记录
- 数据导入：Excel/CSV 批量导入商品、往来单位
- Docker Compose：本地 MySQL + Adminer

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/handler/auth.go

@@ -0,0 +1,68 @@
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/wangjia/jiu/backend/internal/service"
+)
+
+type AuthHandler struct {
+	svc *service.AuthService
+}
+
+func NewAuthHandler(svc *service.AuthService) *AuthHandler {
+	return &AuthHandler{svc: svc}
+}
+
+// Login POST /api/v1/auth/login
+func (h *AuthHandler) Login(c *gin.Context) {
+	var req struct {
+		HotelCode string `json:"hotel_code" binding:"required"`
+		Username  string `json:"username" binding:"required"`
+		Password  string `json:"password" binding:"required"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	pair, user, err := h.svc.Login(req.HotelCode, req.Username, req.Password)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"data": gin.H{
+			"access_token":  pair.AccessToken,
+			"refresh_token": pair.RefreshToken,
+			"expires_in":    pair.ExpiresIn,
+			"user": gin.H{
+				"id":        user.ID,
+				"username":  user.Username,
+				"real_name": user.RealName,
+				"role":      user.Role,
+			},
+		},
+	})
+}
+
+// Refresh POST /api/v1/auth/refresh
+func (h *AuthHandler) Refresh(c *gin.Context) {
+	var req struct {
+		RefreshToken string `json:"refresh_token" binding:"required"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	pair, err := h.svc.RefreshTokens(req.RefreshToken)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"data": pair})
+}