fix(backend): 修复库存 TOCTOU 竞态 + handler 白名单更新 + 对账接口

#29 ApproveStockOut：FOR UPDATE 锁定批次后再内存汇总总量，
     消除预检 SUM 与加锁之间的竞态窗口，减少一次 DB 往返

#30 partner/warehouse/user/product_attr/product_option Update 方法：
     - 绑定到独立 req struct，防止请求体覆盖记录 ID
     - 改用 db.Model.Where("shop_id=?").Updates(map) 白名单更新，
       数据库层强制 shop_id 隔离约束

#31 新增 GET /api/v1/admin/reconcile：对比 inventories 当前库存
     与 inventory_logs 流水净量，返回差异行，用于发现不平账异常

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/handler/product_attr.go

@@ -68,10 +68,9 @@ func (h *ProductAttrHandler) UpdateOrigin(c *gin.Context) {
 		c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
 		return
 	}
-	item.Code = req.Code
-	item.Name = req.Name
-	item.Remark = req.Remark
-	h.db.Save(&item)
+	h.db.Model(&item).Where("shop_id = ?", shopID).Updates(map[string]interface{}{
+		"code": req.Code, "name": req.Name, "remark": req.Remark,
+	})
 	c.JSON(http.StatusOK, gin.H{"data": item})
 }
 
@@ -130,10 +129,9 @@ func (h *ProductAttrHandler) UpdateShelfLife(c *gin.Context) {
 		c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
 		return
 	}
-	item.Code = req.Code
-	item.Name = req.Name
-	item.Remark = req.Remark
-	h.db.Save(&item)
+	h.db.Model(&item).Where("shop_id = ?", shopID).Updates(map[string]interface{}{
+		"code": req.Code, "name": req.Name, "remark": req.Remark,
+	})
 	c.JSON(http.StatusOK, gin.H{"data": item})
 }
 
@@ -192,10 +190,9 @@ func (h *ProductAttrHandler) UpdateStorage(c *gin.Context) {
 		c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
 		return
 	}
-	item.Code = req.Code
-	item.Name = req.Name
-	item.Remark = req.Remark
-	h.db.Save(&item)
+	h.db.Model(&item).Where("shop_id = ?", shopID).Updates(map[string]interface{}{
+		"code": req.Code, "name": req.Name, "remark": req.Remark,
+	})
 	c.JSON(http.StatusOK, gin.H{"data": item})
 }
 
@@ -254,10 +251,9 @@ func (h *ProductAttrHandler) UpdateDescriptionDoc(c *gin.Context) {
 		c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
 		return
 	}
-	item.Title = req.Title
-	item.Content = req.Content
-	item.Remark = req.Remark
-	h.db.Save(&item)
+	h.db.Model(&item).Where("shop_id = ?", shopID).Updates(map[string]interface{}{
+		"title": req.Title, "content": req.Content, "remark": req.Remark,
+	})
 	c.JSON(http.StatusOK, gin.H{"data": item})
 }