fix: 修复代理钱包订单创建逻辑，拆分后台/H5端下单方法并归档变更

- 拆分订单创建为 CreateAdminOrder（后台一步支付）和 CreateH5Order（H5 两步支付）
- 新增 CreateAdminOrderRequest DTO，后台仅允许 wallet/offline 支付方式
- 同步 delta specs 到主规格（order-payment 更新 + admin-order-creation 新增）
- 归档 fix-agent-wallet-order-creation 变更
- 新增 implement-order-expiration 变更提案

internal/handler/admin/order.go

@@ -3,6 +3,7 @@ package admin
 import (
 	"strconv"
 
+	"github.com/go-playground/validator/v10"
 	"github.com/gofiber/fiber/v2"
 
 	"github.com/break/junhong_cmp_fiber/internal/model"
@@ -14,24 +15,35 @@ import (
 	"github.com/break/junhong_cmp_fiber/pkg/response"
 )
 
+// OrderHandler 后台订单处理器
 type OrderHandler struct {
-	service *orderService.Service
+	service   *orderService.Service
+	validator *validator.Validate
 }
 
-func NewOrderHandler(service *orderService.Service) *OrderHandler {
-	return &OrderHandler{service: service}
+// NewOrderHandler 创建后台订单处理器
+func NewOrderHandler(service *orderService.Service, validator *validator.Validate) *OrderHandler {
+	return &OrderHandler{service: service, validator: validator}
 }
 
+// Create 创建后台订单
+// POST /api/admin/orders
 func (h *OrderHandler) Create(c *fiber.Ctx) error {
-	var req dto.CreateOrderRequest
+	var req dto.CreateAdminOrderRequest
 	if err := c.BodyParser(&req); err != nil {
 		return errors.New(errors.CodeInvalidParam, "请求参数解析失败")
 	}
 
+	// 验证请求参数（payment_method 必须为 wallet 或 offline）
+	if err := h.validator.Struct(&req); err != nil {
+		return errors.New(errors.CodeInvalidParam)
+	}
+
 	ctx := c.UserContext()
 	userType := middleware.GetUserTypeFromContext(ctx)
 	shopID := middleware.GetShopIDFromContext(ctx)
 
+	// 线下支付仅限平台用户
 	if req.PaymentMethod == model.PaymentMethodOffline {
 		if userType != constants.UserTypeSuperAdmin && userType != constants.UserTypePlatform {
 			return errors.New(errors.CodeForbidden, "只有平台可以使用线下支付")
@@ -40,6 +52,9 @@ func (h *OrderHandler) Create(c *fiber.Ctx) error {
 		if userType != constants.UserTypeAgent && userType != constants.UserTypePlatform && userType != constants.UserTypeSuperAdmin {
 			return errors.New(errors.CodeForbidden, "无权创建订单")
 		}
+	} else {
+		// 防御性分支：DTO 验证已限制，此处兜底
+		return errors.New(errors.CodeInvalidParam, "后台仅支持钱包支付和线下支付")
 	}
 
 	buyerType := ""
@@ -49,7 +64,7 @@ func (h *OrderHandler) Create(c *fiber.Ctx) error {
 		buyerID = shopID
 	}
 
-	order, err := h.service.Create(ctx, &req, buyerType, buyerID)
+	order, err := h.service.CreateAdminOrder(ctx, &req, buyerType, buyerID)
 	if err != nil {
 		return err
 	}

internal/handler/h5/order.go

@@ -51,7 +51,7 @@ func (h *OrderHandler) Create(c *fiber.Ctx) error {
 		return errors.New(errors.CodeForbidden, "不支持的用户类型")
 	}
 
-	order, err := h.service.Create(ctx, &req, buyerType, buyerID)
+	order, err := h.service.CreateH5Order(ctx, &req, buyerType, buyerID)
 	if err != nil {
 		return err
 	}