feat(backend): 出入库汇总近30天滚动窗口 + 跨租户安全加固

- summaryBounds：本月/近30天滚动双口径（stock-in/out Summary ?window=rolling30）
- security(SEC-001)：新增 ownership.go ensureShopRef 写入侧防线（stock-in/out/finance/
  盘点建单的 warehouse/partner/product 外键归属校验）；读取侧全部 Preload 补
  shop_id 作用域，finance Summary JOIN 补租户条件；回归测试 CrossTenantRefs
- security(SEC-002)：release 模式 JWT 密钥为空/默认值时拒绝启动
- gofmt 对齐若干 model/cmd 文件

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o

backend/cmd/import-history/main_test.go

@@ -4,12 +4,12 @@ import "testing"
 
 func TestMapStatus(t *testing.T) {
 	cases := map[string]string{
-		"已审核": "approved",
-		"待审核": "pending",
-		"被驳回": "rejected",
-		"作废":  "rejected",
-		"":    "draft",
-		"未知":  "draft",
+		"已审核":   "approved",
+		"待审核":   "pending",
+		"被驳回":   "rejected",
+		"作废":    "rejected",
+		"":      "draft",
+		"未知":    "draft",
 		" 已审核 ": "approved",
 	}
 	for in, want := range cases {
@@ -21,12 +21,12 @@ func TestMapStatus(t *testing.T) {
 
 func TestParseFloatLoose(t *testing.T) {
 	cases := map[string]float64{
-		"":          0,
-		"  ":        0,
-		"123":       123,
-		"1,234.50":  1234.5,
-		"abc":       0,
-		"-9.9":      -9.9,
+		"":         0,
+		"  ":       0,
+		"123":      123,
+		"1,234.50": 1234.5,
+		"abc":      0,
+		"-9.9":     -9.9,
 	}
 	for in, want := range cases {
 		if got := parseFloatLoose(in); got != want {