feat: rename qiniu to oss, add admin upload proxy with thumbnail, add dev-login

- Rename all QINIU_* config/code/docs to OSS_* to match actual Alibaba Cloud OSS
- Refactor upload module from internal/common/qiniu to internal/common/upload
- Add backend proxy upload endpoint (POST /api/admin/marketing/upload) to avoid CORS
- Auto-generate compressed thumbnail (800px, JPEG 80%) on admin image upload
- Add dev-login endpoint (POST /api/v1/auth/dev-login) for H5 debugging
- Add imageutil package for server-side image resizing

Made-with: Cursor

internal/routes/admin_routes.go

@@ -108,7 +108,8 @@ func registerAdminRoutes(
 					marketing.DELETE("/templates/:id", templateHandler.AdminDelete)
 
 					marketing.GET("/stats", downloadHandler.AdminStats)
-					marketing.POST("/upload/qiniu/token", downloadHandler.AdminQiniuToken)
+					marketing.POST("/upload/oss/token", downloadHandler.AdminUploadToken)
+				marketing.POST("/upload", downloadHandler.AdminUploadFile)
 				}
 			}
 		}

internal/routes/common_routes.go

@@ -3,19 +3,16 @@ package routes
 import (
 	"github.com/gin-gonic/gin"
 
-	qiniuhandler "wx_service/internal/common/qiniu/handler"
+	uploadhandler "wx_service/internal/common/upload/handler"
 )
 
-func registerCommonPublicRoutes(api *gin.RouterGroup, uploadHandler *qiniuhandler.UploadHandler) {
-	// 七牛上传回调：由七牛服务端调用，不能挂登录鉴权。
-	api.POST("/common/upload/qiniu/callback", uploadHandler.QiniuCallback)
+func registerCommonPublicRoutes(api *gin.RouterGroup, uploadHandler *uploadhandler.UploadHandler) {
+	api.POST("/common/upload/oss/callback", uploadHandler.UploadCallback)
 }
 
-func registerCommonRoutes(protected *gin.RouterGroup, uploadHandler *qiniuhandler.UploadHandler) {
-	// 公共接口（所有小程序共用）
+func registerCommonRoutes(protected *gin.RouterGroup, uploadHandler *uploadhandler.UploadHandler) {
 	common := protected.Group("/common")
 	{
-		// 七牛直传凭证：前端先拿 token，再直传文件到七牛 upload_url
-		common.POST("/upload/qiniu/token", uploadHandler.QiniuToken)
+		common.POST("/upload/oss/token", uploadHandler.GetUploadToken)
 	}
 }

internal/routes/marketing_routes.go

@@ -46,6 +46,7 @@ func registerMarketingRoutes(
 		admin.DELETE("/templates/:id", templateHandler.AdminDelete)
 
 		admin.GET("/stats", downloadHandler.AdminStats)
-		admin.POST("/upload/qiniu/token", downloadHandler.AdminQiniuToken)
+		admin.POST("/upload/oss/token", downloadHandler.AdminUploadToken)
+		admin.POST("/upload", downloadHandler.AdminUploadFile)
 	}
 }

internal/routes/routes.go

@@ -8,7 +8,7 @@ import (
 
 	adminhandler "wx_service/internal/admin"
 	authhandler "wx_service/internal/common/auth/handler"
-	qiniuhandler "wx_service/internal/common/qiniu/handler"
+	uploadhandler "wx_service/internal/common/upload/handler"
 	rediscache "wx_service/internal/common/redis/cache"
 	oahandler "wx_service/internal/common/wechat_official/handler"
 	expiryhandler "wx_service/internal/expiry"
@@ -29,7 +29,7 @@ func Register(
 	smokeHandler *smokehandler.SmokeHandler,
 	quitPlanHandler *smokehandler.QuitPlanHandler,
 	redeemCodeHandler *membershiphandler.RedeemCodeHandler,
-	uploadHandler *qiniuhandler.UploadHandler,
+	uploadHandler *uploadhandler.UploadHandler,
 	oaOAuthHandler *oahandler.OAuthHandler,
 	sessionCache *rediscache.SessionUserCache,
 	lawyerHandler *lawyerhandler.LawyerHandler,
@@ -48,6 +48,8 @@ func Register(
 	{
 		// 登录接口：用微信 code 换取/创建用户并返回 session_key（作为后续 Bearer Token）
 		api.POST("/auth/login", authHandler.LoginWithWeChat)
+		// H5 开发调试登录（仅 debug 模式可用）
+		api.POST("/auth/dev-login", authHandler.DevLogin)
 
 		// 公众号网页授权：不需要登录（code 本身来自微信授权回调）
 		registerWeChatOfficialRoutes(api, oaOAuthHandler)