merge: integrate ZSY customer service and profile capabilities

app/api/controllers/admin.py

@@ -22,6 +22,8 @@ from app.core.contracts import RequestContext
 from app.core.profile_governance_contracts import ProfileDriftReviewRequest
 from app.service.admin_service import AdminService
 from app.service.allocation_backtest_service import AllocationBacktestService
+from app.service.customer_profile_candidate_service import CustomerProfileCandidateService
+from app.service.customer_service_handover_admin_service import CustomerServiceHandoverAdminService
 from app.service.profile_governance_service import ProfileGovernanceService
 
 router = APIRouter(
@@ -204,3 +206,45 @@ async def audit_records(
 ) -> dict[str, Any]:
     """审计查询（文档 §9.6 支持游标过滤）。游标非法时返回 `400 INVALID_CURSOR`。"""
     return await AdminService().query("audit-records", context, limit=limit, cursor=cursor)
+
+
+@router.get("/customer-service/handover-tickets")
+async def list_customer_service_handover_tickets(
+    limit: int = Query(default=20, ge=1, le=100),
+    cursor: str | None = Query(default=None),
+    context: RequestContext = Depends(build_request_context),  # noqa: B008
+) -> dict[str, Any]:
+    """只读查看客服待转人工队列；不暴露原始会话或处理动作。"""
+    return await CustomerServiceHandoverAdminService().list_tickets(
+        context, limit=limit, cursor=cursor
+    )
+
+
+@router.get("/customer-service/handover-tickets/{ticket_no}")
+async def get_customer_service_handover_ticket(
+    ticket_no: str,
+    context: RequestContext = Depends(build_request_context),  # noqa: B008
+) -> dict[str, Any]:
+    """只读查看单个工单的脱敏转接摘要。"""
+    return await CustomerServiceHandoverAdminService().get_ticket(ticket_no, context)
+
+
+@router.get("/customer-profile-candidates")
+async def list_customer_profile_candidates(
+    limit: int = Query(default=20, ge=1, le=100),
+    context: RequestContext = Depends(build_request_context),  # noqa: B008
+) -> dict[str, Any]:
+    """管理员查看待确认或待审核的画像候选。"""
+    return await CustomerProfileCandidateService().list_for_admin(context, limit=limit)
+
+
+@router.post("/customer-profile-candidates/{candidate_id}/reviews", status_code=200)
+async def review_customer_profile_candidate(
+    candidate_id: int,
+    payload: ReviewPayload,
+    context: RequestContext = Depends(build_request_context),  # noqa: B008
+) -> dict[str, Any]:
+    """管理员批准或驳回候选；批准会处理同键旧正式记忆。"""
+    return await CustomerProfileCandidateService().review_by_admin(
+        candidate_id, payload.decision, context, comment=payload.comment
+    )

app/api/controllers/public_platform.py

@@ -1,4 +1,4 @@
-from typing import Any
+from typing import Any, Literal
 
 from fastapi import APIRouter, Depends, Header
 from pydantic import Field
@@ -22,6 +22,10 @@ class Cancellation(StrictPayload):
     reason: str = Field(default="user_cancelled", max_length=128)
 
 
+class CandidateDecisionPayload(StrictPayload):
+    decision: Literal["confirmed", "rejected"]
+
+
 @router.post("/conversations", status_code=201)
 async def create_session(
     payload: SessionCreate,
@@ -90,3 +94,27 @@ async def customer_memory(
     customer_id: int, context: RequestContext = Depends(build_request_context),  # noqa: B008
 ) -> dict[str, Any]:
     return await PublicPlatformService().memory(customer_id, context)
+
+
+@router.get("/users/me/memory-candidates")
+async def my_memory_candidates(
+    context: RequestContext = Depends(build_request_context),  # noqa: B008
+) -> dict[str, Any]:
+    """返回当前用户可确认的画像候选，不返回证据原文。"""
+    from app.service.customer_profile_candidate_service import CustomerProfileCandidateService
+
+    return await CustomerProfileCandidateService().list_for_customer(context)
+
+
+@router.post("/users/me/memory-candidates/{candidate_id}/decisions")
+async def decide_memory_candidate(
+    candidate_id: int,
+    payload: CandidateDecisionPayload,
+    context: RequestContext = Depends(build_request_context),  # noqa: B008
+) -> dict[str, Any]:
+    """用户确认或拒绝自己的候选；确认后仍需管理员审核才能激活。"""
+    from app.service.customer_profile_candidate_service import CustomerProfileCandidateService
+
+    return await CustomerProfileCandidateService().decide_by_customer(
+        candidate_id, payload.decision, context
+    )

app/api/controllers/visitor_tokens.py

@@ -0,0 +1,14 @@
+from fastapi import APIRouter, status
+
+from app.api.schemas.visitor_tokens import VisitorTokenResponse
+from app.core.config import get_settings
+from app.core.security import VisitorTokenIssuer
+
+router = APIRouter(prefix="/api/v1/visitor-tokens", tags=["visitor-tokens"])
+
+
+@router.post("", response_model=VisitorTokenResponse, status_code=status.HTTP_201_CREATED)
+async def issue_visitor_token() -> VisitorTokenResponse:
+    settings = get_settings()
+    token, _expires_at = VisitorTokenIssuer(settings).issue()
+    return VisitorTokenResponse(access_token=token, expires_in=settings.visitor_token_ttl_seconds)

app/api/dependencies/auth.py

@@ -49,7 +49,8 @@ async def build_request_context(
         raise unauthorized()
     try:
         context = _authenticator().authenticate(credentials.credentials)
-        context = await IdentityService().resolve(context)
+        if "visitor" not in context.roles:
+            context = await IdentityService().resolve(context)
     except Exception as exc:
         # 令牌非法、账号停用、角色读取失败一律按 401 处理，形态完全一致。
         raise unauthorized() from exc

app/api/schemas/visitor_tokens.py

@@ -0,0 +1,9 @@
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class VisitorTokenResponse(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    access_token: str = Field(min_length=1)
+    token_type: str = "Bearer"
+    expires_in: int = Field(ge=60, le=3600)