feat(backend): 在线购买/续费对接 pay 收款中枢——下单/webhook 验签入账/续期叠加/查单兜底

- POST /license/purchase（仅管理员）建单并调 pay 下单，返回收银台 pay_url
- POST /pay/callback 公开接收器：HMAC 验签+时间戳窗口+按 out_trade_no 幂等+金额逐分核对，同事务续期
- 续期与兑换券同口径：未过期从到期日叠加、已过期从现在起算，写入 tier/max_devices/features
- 后台每 60s 查单兜底防 webhook 丢失；closed 标 failed
- 新表 license_purchases（schema.sql/AutoMigrate/testutil 同步）；配置 PAY_SECRET/PAY_BASE_URL/PAY_RETURN_URL
- 契约真相源 ~/code/pay-contract openapi.yaml v1.0.0

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o

backend/testutil/setup.go

@@ -150,6 +150,21 @@ func SetupTestDB() *gorm.DB {
 			created_at DATETIME,
 			updated_at DATETIME
 		)`,
+		`CREATE TABLE IF NOT EXISTS license_purchases (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			created_at DATETIME,
+			updated_at DATETIME,
+			deleted_at DATETIME,
+			shop_id INTEGER NOT NULL,
+			user_id INTEGER NOT NULL,
+			product_biz_code TEXT NOT NULL,
+			amount TEXT,
+			out_trade_no TEXT UNIQUE,
+			status TEXT NOT NULL DEFAULT 'pending',
+			trade_no TEXT,
+			channel TEXT,
+			paid_at DATETIME
+		)`,
 		`CREATE TABLE IF NOT EXISTS license_devices (
 			id INTEGER PRIMARY KEY AUTOINCREMENT,
 			license_id INTEGER NOT NULL,