新功能(#3): 抽奖 Stage 1 收官 — 用户 API + 后台 CRUD + 集成

Closes HIF-3

Stage 1 完整闭环 PR C：用户 API + 后台 CRUD + 抽奖事务服务 + 审计 + QA curl。合并后 Stage 1 可交测试。

架构师 review R1（rulecaps depth≤8/nodes≤64/bytes≤8KB）+ R2（InviteHook source_ref 加 order: 前缀）已全部落地。

- 迁移 02158_admin_action_log：后台写操作审计
- xerr 100xxx 段：抽奖错误码（NotEligible/NoChances/ActivityEnded/RateLimited/NotClaimable/InternalError/RuleTooDeep/RuleTooMany/RuleTooLarge）
- feature flag config.Lottery.Enable 默认 false，合并后线上零副作用
- draw service：feature flag → rate limit → pre-tx reads → nonce dedupe → Consume → Pick → 乐观扣库存 → 双快照 → Dispatch → finalize
- 用户 API 4 个：GET /config、POST /draw、GET /records、POST /claim（Stage 1 返回 100010）
- 后台 CRUD：活动 / 奖品 / rules PUT（rulecaps gate）/ chances/grant
- audit.WriteAdminAction：与调用方 tx 同生共死，SHA1 body 摘要
- QA 脚本：qa/lottery/stage1_curl.sh 全链路 curl

测试覆盖：model 76.5% / draw 69% / handler 68.3% / hook 91.9% / rulecaps 87.8% / audit 100%
100 并发抢库存 + 10000 次概率分布 e2e 推 QA 环境（sqlmock 无法忠实模拟 InnoDB 行锁）
CI 全绿：构建/Vet/测试 + golangci-lint

internal/logic/lottery/hook/invite.go

@@ -86,9 +86,12 @@ func (h *defaultInviteHook) run(refererUserID int64, orderNo string) {
 				continue
 			}
 			// ChanceService.Grant is idempotent per (activity_id, source, source_ref).
-			// orderNo as source_ref makes both new-purchase and renewal safe: same
-			// order → same key → at most one chance grant per (activity, order).
-			if err := h.chance.Grant(ctx, refererUserID, activity.Id, lottery.ChanceSourceInviteSuccess, orderNo, amount); err != nil {
+			// Prefix orderNo with "order:" so audit trails can tell business-order
+			// derived refs apart from other source families (manual_grant uses
+			// "manual:*", daily_signin uses "signin:*"). DB uniqueness is already
+			// bucketed by source, but the prefix makes log/analytics readable.
+			ref := "order:" + orderNo
+			if err := h.chance.Grant(ctx, refererUserID, activity.Id, lottery.ChanceSourceInviteSuccess, ref, amount); err != nil {
 				logger.WithContext(ctx).Error("[lottery invite hook] Grant failed",
 					logger.Field("error", err.Error()),
 					logger.Field("referer_user_id", refererUserID),

internal/logic/lottery/hook/invite_test.go

@@ -115,8 +115,8 @@ func TestInviteHook_GrantsForEachRunningActivity(t *testing.T) {
 		if c.source != lottery.ChanceSourceInviteSuccess {
 			t.Fatalf("unexpected source: %+v", c)
 		}
-		if c.sourceRef != "order-xyz" {
-			t.Fatalf("expected orderNo reused as source_ref, got %q", c.sourceRef)
+		if c.sourceRef != "order:order-xyz" {
+			t.Fatalf("expected orderNo prefixed as source_ref, got %q", c.sourceRef)
 		}
 		if c.userId != 42 {
 			t.Fatalf("expected referer=42, got %d", c.userId)