feat: audit diff, mock SMS 999888, env photos, proxy pay lock, mini-user UX

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/integrations/sms/sms-code.store.ts

@@ -1,7 +1,9 @@
 import { BadRequestException, Injectable } from '@nestjs/common';
-import { SMS_CODE_TTL_SECONDS } from '@dukang/shared-types';
+import { MOCK_SMS_FIXED_CODE, SMS_CODE_TTL_SECONDS } from '@dukang/shared-types';
 import { RedisService } from '../../common/redis/redis.service';
 
+export { MOCK_SMS_FIXED_CODE };
+
 const RATE_TTL_SECONDS = 60;
 
 function codeKey(phone: string, scene: string) {
@@ -31,12 +33,15 @@ export class SmsCodeStore {
     await this.redis.client.set(rateKey(phone), '1', 'EX', RATE_TTL_SECONDS);
   }
 
-  async generateAndStore(phone: string, scene: string): Promise<string> {
-    const code = randomSixDigitCode();
+  async storeCode(phone: string, scene: string, code: string): Promise<string> {
     await this.redis.client.set(codeKey(phone, scene), code, 'EX', SMS_CODE_TTL_SECONDS);
     return code;
   }
 
+  async generateAndStore(phone: string, scene: string): Promise<string> {
+    return this.storeCode(phone, scene, randomSixDigitCode());
+  }
+
   async verifyAndConsume(phone: string, scene: string, code: string) {
     const key = codeKey(phone, scene);
     const stored = await this.redis.client.get(key);

server/dukang-api/src/integrations/sms/sms.mock.provider.ts

@@ -2,7 +2,7 @@ import { Injectable, Logger } from '@nestjs/common';
 import { PrismaService } from '../../common/prisma/prisma.module';
 import { MockSmsCodeService } from '../../common/mock-sms-code/mock-sms-code.service';
 import type { ISmsProvider, SmsActorRef, SmsSendResult } from './sms.interface';
-import { SmsCodeStore } from './sms-code.store';
+import { MOCK_SMS_FIXED_CODE, SmsCodeStore } from './sms-code.store';
 
 function maskPhone(phone: string) {
   return `${phone.slice(0, 3)}****${phone.slice(-4)}`;
@@ -19,7 +19,7 @@ export class SmsMockProvider implements ISmsProvider {
   ) {}
 
   async send(phone: string, scene: string, actorRef?: SmsActorRef): Promise<SmsSendResult> {
-    const code = await this.smsCodeStore.generateAndStore(phone, scene);
+    const code = await this.smsCodeStore.storeCode(phone, scene, MOCK_SMS_FIXED_CODE);
     await this.mockSmsCodeService.record(phone, scene, code);
     const masked = maskPhone(phone);
     this.logger.log(`Mock SMS → ${masked} scene=${scene} code=${code}`);