feat: 完善淘宝小程序拍照、报告与登录流程

接入本地实时识别和自动三连拍，调整报告裁切、商品跳转、分享标题及居中页眉；完善游客会话、后台渠道隔离、部署脚本与回归测试。

h5/lib/taobao-auth.js

@@ -18,19 +18,26 @@ function signature(params, body, secret) {
   }
   return crypto.createHash('md5').update(secret + content + secret).digest('hex').toUpperCase();
 }
-function verify(url, body, env = process.env) {
+// Guest requests still require the real signed app gateway, without userInfo
+// authorization or an open_id. Body fields never establish an identity.
+function verifyGateway(url, body, env = process.env) {
   if (!env.TAOBAO_APP_KEY || !env.TAOBAO_APP_SECRET) return null;
   const params = Object.create(null);
   for (const [key, value] of new URL(url, 'http://localhost').searchParams) {
     if (key in params) return null; // Never ambiguously verify duplicate parameters.
     params[key] = value;
   }
-  if (params.app_key !== env.TAOBAO_APP_KEY || !/^[A-Za-z0-9_-]{4,256}$/.test(params.open_id || '') ||
+  if (params.app_key !== env.TAOBAO_APP_KEY ||
       !/^[A-Fa-f0-9]{32,64}$/.test(params.sign || '')) return null;
   const expected = signature(params, body, env.TAOBAO_APP_SECRET);
   if (!expected || expected.length !== params.sign.length ||
       !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(params.sign.toUpperCase()))) return null;
-  // Login challenge is single-use and signed inside the body, preventing replay.
-  return { providerKey: crypto.createHash('sha256').update(params.app_key + ':' + params.open_id).digest('hex') };
+  return { appKey: params.app_key, openId: params.open_id };
 }
-module.exports = { signature, verify };
+function verify(url, body, env = process.env) {
+  const gateway = verifyGateway(url, body, env);
+  if (!gateway || !/^[A-Za-z0-9_-]{4,256}$/.test(gateway.openId || '')) return null;
+  // Login challenge is single-use and signed inside the body, preventing replay.
+  return { providerKey: crypto.createHash('sha256').update(gateway.appKey + ':' + gateway.openId).digest('hex') };
+}
+module.exports = { signature, verify, verifyGateway };