security: 补全剩余端点鉴权 + 移除硬编码管理员后门

1. 鉴权补全
   - orders.py: create_order 补全 Depends(get_current_user)
   - print.py: print_execute 和 update_printer_config 补全鉴权
   - records.py: update_record 和 delete_record 补全鉴权

2. 安全加固
   - auth_service.py: 移除硬编码超级管理员(IRIS/123321)后门
   - 所有用户统一通过MOM sys_user scrypt密码验证登录

backend/app/api/v1/endpoints/orders.py

@@ -9,6 +9,7 @@ from sqlalchemy.orm import selectinload
 from app.core.database import get_db
 from app.models.production_order import ProductionOrder
 from app.schemas.order import OrderCreate, OrderResponse
+from app.services.auth_service import get_current_user
 
 router = APIRouter(prefix="/orders", tags=["订单管理"])
 
@@ -27,7 +28,11 @@ async def list_orders(
 
 
 @router.post("/", response_model=OrderResponse, status_code=201)
-async def create_order(data: OrderCreate, db: AsyncSession = Depends(get_db)):
+async def create_order(
+    data: OrderCreate,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
     order = ProductionOrder(**data.model_dump())
     db.add(order)
     await db.commit()

backend/app/api/v1/endpoints/print.py

@@ -1,9 +1,10 @@
 """标签打印 API — 预览 / 执行 / 打印机配置"""
-from fastapi import APIRouter, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, status
 from pydantic import BaseModel, Field
 
 from app.services.label_service import generate_preview_image, send_to_printer
 from app.services.print_config import PrintConfigManager
+from app.services.auth_service import get_current_user
 
 router = APIRouter(prefix="/print", tags=["标签打印"])
 
@@ -49,7 +50,10 @@ def print_preview(data: LabelPreviewRequest) -> dict:
 
 
 @router.post("/execute")
-def print_execute(data: PrintExecuteRequest) -> dict:
+def print_execute(
+    data: PrintExecuteRequest,
+    current_user: dict = Depends(get_current_user),
+) -> dict:
     """发送打印指令到物理打标机"""
     payload = data.model_dump()
     copies = payload.pop("copies", 1)
@@ -77,7 +81,10 @@ def get_printer_config() -> dict:
 
 
 @router.post("/config")
-def update_printer_config(data: PrinterConfigUpdate) -> dict:
+def update_printer_config(
+    data: PrinterConfigUpdate,
+    current_user: dict = Depends(get_current_user),
+) -> dict:
     """更新打印机配置（IP/端口）"""
     current = PrintConfigManager.get_config()
     current["label_printer"] = {

backend/app/api/v1/endpoints/records.py

@@ -8,6 +8,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.core.database import get_db
 from app.models.task import TaskRecord
 from app.schemas.task import TaskRecordCreate, TaskRecordResponse
+from app.services.auth_service import get_current_user
 
 router = APIRouter(prefix="/records", tags=["任务记录"])
 
@@ -25,6 +26,7 @@ async def update_record(
     record_id: int,
     data: TaskRecordCreate,
     db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
 ):
     """更新任务记录（备注+图片）"""
     record = await _get_record_or_404(db, record_id)
@@ -40,6 +42,7 @@ async def update_record(
 async def delete_record(
     record_id: int,
     db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
 ):
     """删除任务记录"""
     record = await _get_record_or_404(db, record_id)