feat(backend): 出入库汇总近30天滚动窗口 + 跨租户安全加固

- summaryBounds：本月/近30天滚动双口径（stock-in/out Summary ?window=rolling30）
- security(SEC-001)：新增 ownership.go ensureShopRef 写入侧防线（stock-in/out/finance/
  盘点建单的 warehouse/partner/product 外键归属校验）；读取侧全部 Preload 补
  shop_id 作用域，finance Summary JOIN 补租户条件；回归测试 CrossTenantRefs
- security(SEC-002)：release 模式 JWT 密钥为空/默认值时拒绝启动
- gofmt 对齐若干 model/cmd 文件

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o

backend/internal/model/license.go

@@ -4,12 +4,12 @@ import "time"
 
 type License struct {
 	Base
-	ShopID     uint64     `gorm:"not null;index" json:"shop_id"`
-	LicenseKey string     `gorm:"size:768;uniqueIndex" json:"license_key"`
-	Type       string     `gorm:"type:enum('trial','monthly','annual','lifetime');default:'trial'" json:"type"`
+	ShopID     uint64 `gorm:"not null;index" json:"shop_id"`
+	LicenseKey string `gorm:"size:768;uniqueIndex" json:"license_key"`
+	Type       string `gorm:"type:enum('trial','monthly','annual','lifetime');default:'trial'" json:"type"`
 	// Tier 当前权益档位（标准/pro/max…），随兑换码写入；当前默认 'standard'，暂不据此做能力差异。
-	Tier      string     `gorm:"size:32;not null;default:'standard'" json:"tier"`
-	ExpiresAt *time.Time `json:"expires_at"`
+	Tier       string     `gorm:"size:32;not null;default:'standard'" json:"tier"`
+	ExpiresAt  *time.Time `json:"expires_at"`
 	IsActive   bool       `gorm:"default:true" json:"is_active"`
 	MaxDevices int        `gorm:"default:3" json:"max_devices"`
 	Features   JSON       `gorm:"type:json" json:"features,omitempty"`