feat: audit diff, mock SMS 999888, env photos, proxy pay lock, mini-user UX

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/modules/store/store.service.ts

@@ -670,7 +670,7 @@ export class StoreService {
     return this.partnerGetStore(partnerAccountId, storeId);
   }
 
-  /** 重新上传门头照 / 环境照：先软删旧 ENV，再写入去重后的新图（最多 3 张） */
+  /** 重新上传门头照 / 环境照：先软删旧 ENV，再写入去重后的新图（至少 3 张，不设上限） */
   async partnerUpdateStoreMedia(
     partnerAccountId: bigint,
     storeId: bigint,
@@ -1271,7 +1271,7 @@ export class StoreService {
     await this.assertStoreOwnedByAccount(partnerAccountId, storeId);
   }
 
-  private normalizeEnvPhotoUrls(raw: unknown, max = 3): string[] {
+  private normalizeEnvPhotoUrls(raw: unknown): string[] {
     if (!Array.isArray(raw)) return [];
     const seen = new Set<string>();
     const urls: string[] = [];
@@ -1280,7 +1280,6 @@ export class StoreService {
       if (!url || seen.has(url)) continue;
       seen.add(url);
       urls.push(url);
-      if (urls.length >= max) break;
     }
     return urls;
   }