固化七月迭代审计治理进展以隔离线上热修

Constraint: 切换 main 前必须保存当前七月分支全部项目进展，套餐生效提案仅属于 Iteration/7-11。

Rejected: 将七月套餐修复直接移植到 main | 两个分支的可靠投递架构不同。

Confidence: medium

Scope-risk: broad

Directive: 不得将本提交整体 cherry-pick 到 main；main 套餐热修必须基于其纯 Asynq 代码独立实施。

Tested: git diff --check；openspec validate fix-package-activation-starvation --strict。

Not-tested: 按用户要求未运行自动化测试；go build ./... 因当前审计改造中的 Enterprise 模型字面量和 role.recordFailure 参数类型错误未通过。

pkg/logger/middleware.go

@@ -7,6 +7,7 @@ import (
 	"net/url"
 	"time"
 
+	"github.com/break/junhong_cmp_fiber/pkg/auditcontext"
 	"github.com/break/junhong_cmp_fiber/pkg/constants"
 	"github.com/break/junhong_cmp_fiber/pkg/sanitizer"
 	"github.com/bytedance/sonic"
@@ -154,8 +155,10 @@ func MiddlewareWithLogger(accessLogger *zap.Logger) fiber.Handler {
 
 		// 注入请求上下文，供 Service 层审计日志复用
 		ctx := c.UserContext()
+		requestID := ""
 		if rid := c.Locals(constants.ContextKeyRequestID); rid != nil {
-			if requestID, ok := rid.(string); ok && requestID != "" {
+			if value, ok := rid.(string); ok && value != "" {
+				requestID = value
 				ctx = context.WithValue(ctx, constants.ContextKeyRequestID, requestID)
 			}
 		}
@@ -163,6 +166,11 @@ func MiddlewareWithLogger(accessLogger *zap.Logger) fiber.Handler {
 		ctx = context.WithValue(ctx, constants.ContextKeyUserAgent, c.Get("User-Agent"))
 		ctx = context.WithValue(ctx, constants.ContextKeyRequestPath, c.Path())
 		ctx = context.WithValue(ctx, constants.ContextKeyRequestMethod, c.Method())
+		ctx = auditcontext.With(ctx, auditcontext.Context{
+			RequestID: requestID, CorrelationID: requestID,
+			RequestPath: c.Path(), RequestMethod: c.Method(),
+			IPAddress: c.IP(), UserAgent: c.Get("User-Agent"),
+		})
 		c.SetUserContext(ctx)
 
 		// 获取请求 body（在 c.Next() 之前读取）
@@ -182,7 +190,7 @@ func MiddlewareWithLogger(accessLogger *zap.Logger) fiber.Handler {
 		duration := time.Since(startTime)
 
 		// 获取请求 ID（由 requestid 中间件设置）
-		requestID := ""
+		requestID = ""
 		if rid := c.Locals(constants.ContextKeyRequestID); rid != nil {
 			requestID = rid.(string)
 		}