修复(#3): 抽奖 Stage 1 后台审计 IP/UA 丢失 + 冒烟脚本 Bearer 前缀

Closes HIF-3 (Stage 1 P1 defects from QA smoke report)

F2: admin_action_log.ip / user_agent 恒为空
- 根因：requestMeta 从 ctx 读裸字符串 key，全库无 writer 塞
- 修复：新增 AdminMetaMiddleware 用 typed constant.CtxKeyIP / CtxKeyUserAgent
- 挂载：lottery admin 组末尾（不 gate access）
- 回归护栏：UsesTypedKey + IgnoresBareStringKeys 双向断言 typed key，防止未来退化回裸字符串

F3: qa/lottery/stage1_curl.sh Bearer 前缀
- 删除两处 Bearer 前缀 + 加注释说明 ppanel AuthMiddleware 不 strip

单测 5 用例全绿；scope 严格限于 lottery admin 组，其它路径零改动；无 DB 变更。

Merged: architect review 后，将触发 staging 二次部署 — 期望这次能一并解决 shanshanzhong147 手工 SSH 后 Lottery.Enable=true 未生效的问题（若真是 mount/restart 未正确 pick up）。

internal/logic/admin/lottery/lottery.go

@@ -35,11 +35,13 @@ func currentAdminId(ctx context.Context) int64 {
 }
 
 func requestMeta(ctx context.Context) (ip, ua string) {
-	// AuthMiddleware attaches gin.Context; we accept absence gracefully.
-	if v, ok := ctx.Value("ip").(string); ok {
+	// AdminMetaMiddleware populates these keys on the request context after
+	// AuthMiddleware runs. Absent middleware (unit tests, non-admin paths)
+	// → empty strings, which is the intended defensive default.
+	if v, ok := ctx.Value(constant.CtxKeyIP).(string); ok {
 		ip = v
 	}
-	if v, ok := ctx.Value("user_agent").(string); ok {
+	if v, ok := ctx.Value(constant.CtxKeyUserAgent).(string); ok {
 		ua = v
 	}
 	return

internal/logic/admin/lottery/request_meta_test.go

@@ -0,0 +1,51 @@
+package lottery
+
+import (
+	"context"
+	"testing"
+
+	"github.com/perfect-panel/server/pkg/constant"
+)
+
+// TestRequestMeta_EmptyWhenCtxUnset asserts requestMeta returns empty strings
+// when neither typed context key is populated (unit tests, non-admin paths).
+func TestRequestMeta_EmptyWhenCtxUnset(t *testing.T) {
+	ip, ua := requestMeta(context.Background())
+	if ip != "" || ua != "" {
+		t.Fatalf("expected empty, got ip=%q ua=%q", ip, ua)
+	}
+}
+
+// TestRequestMeta_ReadsTypedKeys asserts requestMeta picks up the values
+// AdminMetaMiddleware pins onto ctx via the typed CtxKey constants.
+func TestRequestMeta_ReadsTypedKeys(t *testing.T) {
+	ctx := context.Background()
+	ctx = context.WithValue(ctx, constant.CtxKeyIP, "10.99.99.7")
+	ctx = context.WithValue(ctx, constant.CtxKeyUserAgent, "qa-audit-probe")
+
+	ip, ua := requestMeta(ctx)
+	if ip != "10.99.99.7" {
+		t.Fatalf("ip = %q, want %q", ip, "10.99.99.7")
+	}
+	if ua != "qa-audit-probe" {
+		t.Fatalf("ua = %q, want %q", ua, "qa-audit-probe")
+	}
+}
+
+// TestRequestMeta_IgnoresBareStringKeys guards against the F2 root cause:
+// pre-fix, the writer used bare-string keys "ip" / "user_agent" which never
+// collided with anyone's typed reader — so audit rows always saw empty
+// strings. The test proves the reader now IGNORES bare-string writes: only
+// the typed CtxKey path counts.
+func TestRequestMeta_IgnoresBareStringKeys(t *testing.T) {
+	ctx := context.Background()
+	//nolint:staticcheck // intentional bare-string key to prove reader ignores it
+	ctx = context.WithValue(ctx, "ip", "should-be-ignored")
+	//nolint:staticcheck // intentional bare-string key to prove reader ignores it
+	ctx = context.WithValue(ctx, "user_agent", "should-be-ignored")
+
+	ip, ua := requestMeta(ctx)
+	if ip != "" || ua != "" {
+		t.Fatalf("bare-string keys must be ignored; got ip=%q ua=%q", ip, ua)
+	}
+}