fix(backend): 修复库存 TOCTOU 竞态 + handler 白名单更新 + 对账接口

#29 ApproveStockOut：FOR UPDATE 锁定批次后再内存汇总总量，
     消除预检 SUM 与加锁之间的竞态窗口，减少一次 DB 往返

#30 partner/warehouse/user/product_attr/product_option Update 方法：
     - 绑定到独立 req struct，防止请求体覆盖记录 ID
     - 改用 db.Model.Where("shop_id=?").Updates(map) 白名单更新，
       数据库层强制 shop_id 隔离约束

#31 新增 GET /api/v1/admin/reconcile：对比 inventories 当前库存
     与 inventory_logs 流水净量，返回差异行，用于发现不平账异常

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/handler/user.go

@@ -83,19 +83,23 @@ func (h *UserHandler) Update(c *gin.Context) {
 		IsActive *bool  `json:"is_active"`
 	}
 	c.ShouldBindJSON(&req)
+	updates := map[string]interface{}{}
 	if req.RealName != "" {
-		u.RealName = req.RealName
+		updates["real_name"] = req.RealName
 	}
 	if req.Phone != "" {
-		u.Phone = req.Phone
+		updates["phone"] = req.Phone
 	}
 	if req.Role != "" {
-		u.Role = req.Role
+		updates["role"] = req.Role
 	}
 	if req.IsActive != nil {
-		u.IsActive = *req.IsActive
+		updates["is_active"] = *req.IsActive
 	}
-	h.db.Save(&u)
+	if len(updates) > 0 {
+		h.db.Model(&u).Where("shop_id = ?", shopID).Updates(updates)
+	}
+	h.db.Where("id = ? AND shop_id = ?", u.ID, shopID).First(&u)
 	c.JSON(http.StatusOK, gin.H{"data": u})
 }