chore: release server-v1.0.62

服务端安全加固：多维限流（按 IP/按门店）+ 敏感接口独立速率上限抵御 DDoS/刷接口；
登录暴力破解新增按来源 IP 锁定；反代后正确识别真实客户端 IP；
门店 custom_fields 轻量配置（录入默认值）透传保存。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y2Wdwo7SmgBJU37cBrkhPK

backend/internal/handler/shop.go

@@ -42,12 +42,13 @@ func (h *ShopHandler) UpdateInfo(c *gin.Context) {
 	shopID := middleware.GetShopID(c)
 
 	var req struct {
-		Name        string `json:"name"`
-		Address     string `json:"address"`
-		Phone       string `json:"phone"`
-		ManagerName string `json:"manager_name"`
-		LogoURL     string `json:"logo_url"`
-		WechatID    string `json:"wechat_id"`
+		Name         string                 `json:"name"`
+		Address      string                 `json:"address"`
+		Phone        string                 `json:"phone"`
+		ManagerName  string                 `json:"manager_name"`
+		LogoURL      string                 `json:"logo_url"`
+		WechatID     string                 `json:"wechat_id"`
+		CustomFields map[string]interface{} `json:"custom_fields"`
 	}
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
@@ -64,6 +65,19 @@ func (h *ShopHandler) UpdateInfo(c *gin.Context) {
 	if req.LogoURL != "" {
 		updates["logo_url"] = req.LogoURL
 	}
+	// custom_fields 增量 merge：保留已有键（如其它店级配置），只覆盖本次传入的键。
+	if req.CustomFields != nil {
+		var cur model.Shop
+		h.db.Select("custom_fields").Where("id = ?", shopID).First(&cur)
+		merged := model.JSON{}
+		for k, v := range cur.CustomFields {
+			merged[k] = v
+		}
+		for k, v := range req.CustomFields {
+			merged[k] = v
+		}
+		updates["custom_fields"] = merged
+	}
 	if err := h.db.Model(&model.Shop{}).Where("id = ?", shopID).Updates(updates).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return