feat: rename qiniu to oss, add admin upload proxy with thumbnail, add dev-login

- Rename all QINIU_* config/code/docs to OSS_* to match actual Alibaba Cloud OSS
- Refactor upload module from internal/common/qiniu to internal/common/upload
- Add backend proxy upload endpoint (POST /api/admin/marketing/upload) to avoid CORS
- Auto-generate compressed thumbnail (800px, JPEG 80%) on admin image upload
- Add dev-login endpoint (POST /api/v1/auth/dev-login) for H5 debugging
- Add imageutil package for server-side image resizing

Made-with: Cursor

internal/common/auth/handler/auth_handler.go

@@ -2,6 +2,7 @@ package handler
 
 import (
 	"errors"
+	"log"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
@@ -107,3 +108,43 @@ func (h *AuthHandler) LoginWithWeChat(c *gin.Context) {
 		"mini_program": miniProgramPayload,
 	}))
 }
+
+type devLoginRequest struct {
+	MiniProgramID uint `json:"mini_program_id"`
+}
+
+// DevLogin 仅在非 release 模式下可用，用于 H5 开发调试。
+func (h *AuthHandler) DevLogin(c *gin.Context) {
+	if gin.Mode() == gin.ReleaseMode {
+		c.JSON(http.StatusNotFound, model.Error(http.StatusNotFound, "not found"))
+		return
+	}
+
+	var req devLoginRequest
+	_ = c.ShouldBindJSON(&req)
+	if req.MiniProgramID == 0 {
+		req.MiniProgramID = 3
+	}
+
+	result, err := h.authService.DevLogin(c.Request.Context(), req.MiniProgramID)
+	if err != nil {
+		log.Printf("[dev_login] error: %v", err)
+		c.JSON(http.StatusInternalServerError, model.Error(http.StatusInternalServerError, "dev login failed: "+err.Error()))
+		return
+	}
+
+	c.JSON(http.StatusOK, model.Success(gin.H{
+		"user": gin.H{
+			"id":              result.User.ID,
+			"mini_program_id": result.User.MiniProgramID,
+			"open_id":         result.User.OpenID,
+			"nickname":        result.User.NickName,
+			"avatar_url":      result.User.AvatarURL,
+		},
+		"session_key": result.SessionKey,
+		"mini_program": gin.H{
+			"id":   result.MiniProgram.ID,
+			"name": result.MiniProgram.Name,
+		},
+	}))
+}