feat(backend): 授权订单列表接口——分页/筛选/汇总，支撑订单管理 tab

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/internal/handler/pay.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"log"
 	"net/http"
+	"strconv"
 	"strings"
 
 	"github.com/gin-gonic/gin"
@@ -112,6 +113,39 @@ func (h *PayHandler) Cancel(c *gin.Context) {
 	util.RespondSuccess(c, gin.H{"canceled": canceled})
 }
 
+// Purchases GET /api/v1/license/purchases — 订单管理 tab 数据源：分页/status 筛选/汇总。
+// 仅管理员可查看（handler 内判权，同 Purchase）。
+func (h *PayHandler) Purchases(c *gin.Context) {
+	role := middleware.GetRole(c)
+	if role != "admin" && role != "superadmin" {
+		c.JSON(http.StatusForbidden, gin.H{"error": "仅管理员可查看订单"})
+		return
+	}
+	page, _ := strconv.Atoi(c.Query("page"))
+	if page < 1 {
+		page = 1
+	}
+	pageSize, _ := strconv.Atoi(c.Query("page_size"))
+	if pageSize < 1 {
+		pageSize = 20
+	}
+	if pageSize > 100 {
+		pageSize = 100
+	}
+	status := c.Query("status")
+
+	list, err := h.svc.ListPurchases(middleware.GetShopID(c), page, pageSize, status)
+	if err != nil {
+		if errors.Is(err, service.ErrInvalidStatus) {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	util.RespondSuccess(c, list)
+}
+
 // PromoStatus GET /api/v1/license/promo-status — 本店首月特惠是否已享用（前端据此置灰特惠档）。
 func (h *PayHandler) PromoStatus(c *gin.Context) {
 	used, err := h.svc.PromoUsed(middleware.GetShopID(c))