feat(backend): 库存列表列头排序——库存/成本价/总价/生产日期/入库时间全局排序

sort_by 白名单列映射 SQL 表达式（cost/price/prod_date 与 SELECT 同 COALESCE
口径，排序与显示一致）+ sort_dir，非法值忽略回默认；id 兜底保证分页稳定。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o

backend/internal/handler/inventory.go

@@ -158,6 +158,23 @@ func (h *InventoryHandler) List(c *gin.Context) {
 		return
 	}
 
+	// 排序（2026-07-07 列头排序）：白名单列 → SQL 表达式，防注入；带 id 兜底保证分页稳定。
+	// cost/price/prod_date 用与 SELECT 相同的 COALESCE 口径，排序结果与显示一致。
+	orderExpr := "inv.id DESC"
+	if sortCol, ok := map[string]string{
+		"qty":       "inv.quantity",
+		"cost":      "COALESCE(sii.cost_price, inv.unit_price, p.purchase_price)",
+		"price":     "inv.quantity * COALESCE(sii.cost_price, inv.unit_price, p.purchase_price)",
+		"prod_date": "COALESCE(DATE(sii.production_date), DATE(inv.production_date))",
+		"in_time":   "inv.created_at",
+	}[c.Query("sort_by")]; ok {
+		dir := "ASC"
+		if c.Query("sort_dir") == "desc" {
+			dir = "DESC"
+		}
+		orderExpr = sortCol + " " + dir + ", inv.id DESC"
+	}
+
 	// Data query
 	dataSQL := `
 		SELECT
@@ -183,7 +200,7 @@ func (h *InventoryHandler) List(c *gin.Context) {
 		LEFT JOIN products p ON p.id = inv.product_id AND p.deleted_at IS NULL
 		LEFT JOIN warehouses w ON w.id = inv.warehouse_id
 		WHERE ` + baseWhere + `
-		ORDER BY inv.id DESC
+		ORDER BY ` + orderExpr + `
 		LIMIT ? OFFSET ?`
 
 	dataArgs := append(args, pageSize, (page-1)*pageSize)

backend/internal/handler/inventory_test.go

@@ -3,6 +3,7 @@ package handler
 import (
 	"fmt"
 	"net/http"
+	"net/http/httptest"
 	"testing"
 	"time"
 
@@ -525,3 +526,44 @@ func TestInventoryHandler_StatusTenantIsolation(t *testing.T) {
 	require.NoError(t, db.Where("id = ?", invB.ID).First(&got).Error)
 	assert.Equal(t, "stock", got.Status)
 }
+
+// 列头排序（2026-07-07）：白名单列全局排序，非法列忽略回默认
+func TestInventoryHandler_ListSort(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "INV_SORT")
+	user := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	wh := testutil.CreateTestWarehouse(db, shop.ID, "仓")
+	token := getAuthToken(user.ID, shop.ID, "admin")
+	r := setupProtectedRouter(db)
+
+	for i, qty := range []float64{5, 20, 10} {
+		p := testutil.CreateTestProduct(db, shop.ID, fmt.Sprintf("酒%d", i))
+		price := float64(100 * (i + 1))
+		require.NoError(t, db.Create(&model.Inventory{
+			ShopID: shop.ID, WarehouseID: &wh.ID, ProductID: &p.ID,
+			Quantity: qty, UnitPrice: &price,
+		}).Error)
+	}
+
+	qtys := func(w *httptest.ResponseRecorder) []float64 {
+		rows := parseResponse(w)["data"].([]interface{})
+		out := make([]float64, len(rows))
+		for i, r := range rows {
+			out[i] = r.(map[string]interface{})["quantity"].(float64)
+		}
+		return out
+	}
+
+	// qty 升序
+	w := makeRequest(r, "GET", "/api/v1/inventory?sort_by=qty&sort_dir=asc", token, nil)
+	assert.Equal(t, []float64{5, 10, 20}, qtys(w))
+	// qty 降序
+	w = makeRequest(r, "GET", "/api/v1/inventory?sort_by=qty&sort_dir=desc", token, nil)
+	assert.Equal(t, []float64{20, 10, 5}, qtys(w))
+	// 总价 = qty×进价：5×100=500, 20×200=4000, 10×300=3000 → 升序 5,10,20
+	w = makeRequest(r, "GET", "/api/v1/inventory?sort_by=price&sort_dir=asc", token, nil)
+	assert.Equal(t, []float64{5, 10, 20}, qtys(w))
+	// 非法列忽略 → 默认 id 倒序（最后插入的 qty=10 在前）
+	w = makeRequest(r, "GET", "/api/v1/inventory?sort_by=evil;drop", token, nil)
+	assert.Equal(t, []float64{10, 20, 5}, qtys(w))
+}