feat(catalog): product visibility whitelist by phone

Admin can limit ON_SALE products to test phones; C-end filters by user phone.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/prisma/schema.prisma

@@ -593,18 +593,35 @@ model CommonProductItem {
   status          ProductStatus @default(DRAFT)
   sortOrder       Int           @default(0) @map("sort_order")
   allowOnSitePickup Boolean     @default(false) @map("allow_on_site_pickup")
+  /// Online test: only listed phones can see/buy when enabled
+  visibilityWhitelistEnabled Boolean @default(false) @map("visibility_whitelist_enabled")
   coverResourceId BigInt?       @map("cover_resource_id") @db.UnsignedBigInt
   detailContent   Json?         @map("detail_content")
   createdAt       DateTime      @default(now()) @map("created_at") @db.DateTime(3)
   updatedAt       DateTime      @updatedAt @map("updated_at") @db.DateTime(3)
 
-  coverResource CommonResource? @relation("ProductCover", fields: [coverResourceId], references: [id], onDelete: SetNull)
-  orders        Order[]
+  coverResource     CommonResource?                 @relation("ProductCover", fields: [coverResourceId], references: [id], onDelete: SetNull)
+  orders            Order[]
+  visibilityPhones  CommonProductVisibilityPhone[]
 
   @@index([status, aromaType])
   @@map("common_product_item")
 }
 
+/// Product visibility whitelist phones (match by bound phone)
+model CommonProductVisibilityPhone {
+  id        BigInt   @id @default(autoincrement()) @db.UnsignedBigInt
+  productId BigInt   @map("product_id") @db.UnsignedBigInt
+  phone     String   @db.VarChar(20)
+  createdAt DateTime @default(now()) @map("created_at") @db.DateTime(3)
+
+  product CommonProductItem @relation(fields: [productId], references: [id], onDelete: Cascade)
+
+  @@unique([productId, phone])
+  @@index([phone])
+  @@map("common_product_visibility_phone")
+}
+
 model CommonProductDetailTemplate {
   id                        BigInt               @id @default(autoincrement()) @db.UnsignedBigInt
   code                      String               @unique @db.VarChar(32)