feat(backend): 出入库汇总近30天滚动窗口 + 跨租户安全加固

- summaryBounds：本月/近30天滚动双口径（stock-in/out Summary ?window=rolling30）
- security(SEC-001)：新增 ownership.go ensureShopRef 写入侧防线（stock-in/out/finance/
  盘点建单的 warehouse/partner/product 外键归属校验）；读取侧全部 Preload 补
  shop_id 作用域，finance Summary JOIN 补租户条件；回归测试 CrossTenantRefs
- security(SEC-002)：release 模式 JWT 密钥为空/默认值时拒绝启动
- gofmt 对齐若干 model/cmd 文件

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o

backend/internal/handler/finance.go

@@ -27,7 +27,7 @@ func (h *FinanceHandler) ListRecords(c *gin.Context) {
 
 	var q struct {
 		Type      string `form:"type"`
-		Month     string `form:"month"` // e.g. "2026-04"
+		Month     string `form:"month"`      // e.g. "2026-04"
 		StartDate string `form:"start_date"` // YYYY-MM-DD（区间过滤，优先于 month）
 		EndDate   string `form:"end_date"`
 		PartnerID uint64 `form:"partner_id"`
@@ -67,7 +67,7 @@ func (h *FinanceHandler) ListRecords(c *gin.Context) {
 
 	records := make([]model.FinanceRecord, 0)
 	offset := (q.Page - 1) * q.PageSize
-	base.Preload("Partner").Order("record_date DESC, id DESC").Offset(offset).Limit(q.PageSize).Find(&records)
+	base.Preload("Partner", "shop_id = ?", shopID).Order("record_date DESC, id DESC").Offset(offset).Limit(q.PageSize).Find(&records)
 
 	c.JSON(http.StatusOK, gin.H{
 		"data":      records,
@@ -93,6 +93,11 @@ func (h *FinanceHandler) Create(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
+	// SEC-001：往来单位必须属于当前店（防跨租户引用泄露）
+	if err := ensureShopRefOpt(h.db, "partners", req.PartnerID, shopID); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
 	if req.Type != "payment" && req.Type != "receipt" {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "type must be payment or receipt"})
 		return
@@ -236,7 +241,7 @@ func (h *FinanceHandler) Summary(c *gin.Context) {
 		       COUNT(*) AS record_count,
 		       SUM(f.amount) AS total_amount
 		FROM finance_records f
-		LEFT JOIN partners p ON p.id = f.partner_id
+		LEFT JOIN partners p ON p.id = f.partner_id AND p.shop_id = f.shop_id
 		WHERE f.shop_id = ? AND f.deleted_at IS NULL
 		  AND f.type IN ('payable','receivable')
 		  AND f.status = 'open'