fix(security): stop operator identity from reaching user endpoints; guard path rules

Continues the HTTP-semantics work. Fixing 401/403 exposed a worse defect on the
same axis: who is allowed to reach which endpoint.

Root cause chain:
- PlatformPrincipal has two implementations (OperatorPrincipal / UserPrincipal),
  chosen by JwtAuthFilter from the token type.
- `@AuthenticationPrincipal UserPrincipal` against an OperatorPrincipal is a type
  mismatch, and Spring Security returns null (errorOnInvalidType defaults to
  false) instead of failing.
- 244 uses of that annotation repo-wide; only 48 null-check. The rest NPE -> 500
  when reached with an operator identity.
- The fallback rule was `.authenticated()`, which an operator token satisfies, so
  such requests did reach user-facing controllers.

Adding ~196 null checks would be mechanical, easy to miss, and does nothing to
constrain future code. The mismatch is between identity type and endpoint, so it
is fixed once, at the authentication layer: the fallback becomes
`.hasRole("USER")` (operator -> ROLE_OPERATOR, user -> ROLE_USER, per JwtAuthFilter).
Operator requests to user endpoints now get 403 before any controller runs.

Trap worth recording: operator endpoints are not all under /operator/ —
/counseling/services/operator/queue, /content/operator/articles,
/activities/operator/checkin/scan, /service-appointments/operator/list and others
sit deeper inside business paths. The first attempt covered them with
`requestMatchers("/**/operator/**")`, which fails at runtime:

  PatternParseException: No more pattern data allowed after {*...} or ** pattern element

Spring's PathPattern permits `**` only as the final element. Worse, the symptom is
a 500 from the whole filter chain (Tomcat HTML error page, not our JSON), and E2E
went from 37 passed to 33 failed — an error far removed from its cause. Now the
nine prefixes are listed explicitly, each ending in /**.

Because explicit enumeration can be forgotten as endpoints are added, and because
the failure mode is "operators locked out of their own admin module" (invisible to
user-side tests), SecurityPathCoverageTest parses the OPERATOR rule prefixes out of
SecurityConfig source, walks every *Controller.java, joins class-level and
method-level mapping paths, and asserts every path containing /operator/ is
covered (/auth/operator/** excluded by design). Two things that would silently
neuter it, both handled: it must parse only the .hasRole("OPERATOR") chain — pulling
in the permitAll or fallback rules would mark everything covered — and the test
working directory is the repo root, not the Maven module root.

Verification: negatively validated by removing /content/operator/** -> exactly one
test turns red listing the six affected ContentController endpoints; restored.
E2E 40 passed (37 + 3 identity-isolation cases). Backend regression 664 / 0
failures / 0 errors / 3 skipped.

backend/src/main/java/com/danyang/match/platform/shared/config/SecurityConfig.java

@@ -71,12 +71,54 @@ public class SecurityConfig {
                         .requestMatchers("/app/config").permitAll()
                         .requestMatchers("/activities").permitAll()
                         .requestMatchers("/auth/**").authenticated()
-                        // 操作台接口需要认证
-                        .requestMatchers("/operator/**").hasRole("OPERATOR")
-                        // 管理接口需要认证
-                        .requestMatchers("/admin/**").hasRole("OPERATOR")
-                        // 其他所有用户接口需要认证（覆盖 /api/v1/** 中未匹配的）
-                        .requestMatchers("/**").authenticated()
+                        /**
+                         * 运营端接口要求 OPERATOR 角色。
+                         *
+                         * <p>除了顶层的 {@code /operator/**}，还必须逐个列出「嵌在业务路径下」的
+                         * 运营端点，例如 {@code /counseling/services/operator/queue}、
+                         * {@code /content/operator/articles}、
+                         * {@code /activities/operator/checkin/scan}、
+                         * {@code /service-appointments/operator/list}。
+                         * 漏掉任何一个，该端点都会掉进下面的 ROLE_USER 规则，
+                         * 导致运营人员被自己的平台拒绝（管理端对应模块直接不可用）。
+                         *
+                         * <p><b>不要试图用 {@code /**}{@code /operator/**} 一行覆盖</b>：
+                         * Spring 的 PathPattern 语法不允许 {@code **} 出现在中间
+                         * （只有末尾才允许），写了会在运行时抛
+                         * {@code PatternParseException: No more pattern data allowed after ** pattern element}，
+                         * 且表现为整个过滤器链 500 —— 已实测踩过。
+                         *
+                         * <p>这些前缀由 {@code SecurityPathCoverageTest} 机械校验：
+                         * 源码中任何含 operator 的端点路径都必须被这里的规则覆盖。
+                         */
+                        .requestMatchers(
+                                "/operator/**",
+                                "/admin/**",
+                                "/counseling/services/operator/**",
+                                "/content/operator/**",
+                                "/risk/operator/**",
+                                "/activities/operator/**",
+                                "/service-appointments/operator/**",
+                                "/service-programs/operator/**",
+                                "/referrals/operator/**")
+                        .hasRole("OPERATOR")
+                        /**
+                         * 其余接口必须持用户身份（ROLE_USER），不再只是"已认证"。
+                         *
+                         * <p>此前这里是 {@code authenticated()}：运营 token 也算"已认证"，
+                         * 于是能用运营账号去打用户端端点。而
+                         * {@code @AuthenticationPrincipal UserPrincipal} 遇到 OperatorPrincipal
+                         * 属类型不匹配，Spring Security 默认返回 <b>null</b>
+                         * （{@code errorOnInvalidType=false}）——
+                         * 全仓 244 处使用该注解，仅 48 处做了 null 检查，
+                         * 其余端点会直接 NPE → 500。
+                         *
+                         * <p>与其补上百处 null 判断（机械、易漏、且无法约束将来新增的代码），
+                         * 不如在认证层按身份类型挡住：运营身份访问用户端一律 403，
+                         * 请求根本进不到 Controller。身份与角色的对应关系见 JwtAuthFilter：
+                         * 运营 → ROLE_OPERATOR + 权限；用户 → ROLE_USER。
+                         */
+                        .requestMatchers("/**").hasRole("USER")
                         // 其他所有请求放行（避免 denyAll 导致未知路径也被拦截）
                         .anyRequest().permitAll()
                 )

backend/src/test/java/com/danyang/match/platform/shared/config/SecurityPathCoverageTest.java

@@ -0,0 +1,169 @@
+package com.danyang.match.platform.shared.config;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import java.util.stream.Stream;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * 机械校验：源码里每个「运营端点」都必须被 SecurityConfig 的 OPERATOR 规则覆盖。
+ *
+ * <p>为什么需要：运营端点并不都在 {@code /operator/} 下。部分业务控制器把运营端点
+ * 嵌在深层路径里（{@code /counseling/services/operator/queue}、
+ * {@code /content/operator/articles}、{@code /service-appointments/operator/list} …）。
+ * 一旦某个这类端点没被显式纳入 OPERATOR 规则，它会掉进兜底的 ROLE_USER 规则，
+ * 结果是<b>运营人员被自己的平台拒绝</b>——管理端对应模块直接不可用，
+ * 而这在只跑用户侧测试时完全看不出来。
+ *
+ * <p>不能靠 {@code /**}{@code /operator/**} 一行通配解决：PathPattern 不允许
+ * {@code **} 出现在中间，写了会抛 PatternParseException 并把整个过滤器链打成 500。
+ * 所以只能显式枚举 —— 那就必须有人盯着别漏，这个测试就是那个人。
+ */
+class SecurityPathCoverageTest {
+
+    private static final Path SRC_ROOT = resolveSourceRoot();
+    private static final Path SECURITY_CONFIG = SRC_ROOT.resolve(
+            "com/danyang/match/platform/shared/config/SecurityConfig.java");
+
+    /**
+     * 定位源码根目录。
+     *
+     * <p>测试的工作目录在本环境下是<b>仓库根</b>而非 Maven 模块根
+     * （同项目 `MigrationValidationTest` 也以 `backend/target/...` 形式引用产物），
+     * 但不同执行方式下可能不同。两种候选都试一遍，比写死一个更稳。
+     */
+    private static Path resolveSourceRoot() {
+        for (String candidate : new String[]{"src/main/java", "backend/src/main/java"}) {
+            Path path = Path.of(candidate);
+            if (Files.isDirectory(path)) {
+                return path;
+            }
+        }
+        throw new IllegalStateException(
+                "无法定位源码根目录（尝试过 src/main/java 与 backend/src/main/java）；当前工作目录="
+                        + Path.of("").toAbsolutePath());
+    }
+
+    @Test
+    @DisplayName("源码中所有运营端点路径都被 SecurityConfig 的 OPERATOR 规则覆盖")
+    void everyOperatorEndpointIsGuardedByOperatorRule() throws IOException {
+        Set<String> prefixes = operatorRulePrefixes();
+        // 健全性检查：确认解析器真的取到了 OPERATOR 规则（而非 permitAll 之类）。
+        // 若这条挂了，说明下面是"零覆盖也算全通过"的假绿，必须先修解析逻辑。
+        assertTrue(prefixes.contains("/operator/**"),
+                "未能从 SecurityConfig 解析出运营规则前缀，测试本身已失效。实际解析结果：" + prefixes);
+
+        List<String> unguarded = new ArrayList<>();
+        try (Stream<Path> files = Files.walk(SRC_ROOT)) {
+            for (Path file : files.filter(p -> p.toString().endsWith("Controller.java")).toList()) {
+                String src = Files.readString(file);
+                String classPath = firstMappingPath(src);
+                for (String methodPath : methodMappingPaths(src)) {
+                    String full = join(classPath, methodPath);
+                    if (isOperatorPath(full) && !isCovered(full, prefixes)) {
+                        unguarded.add(file.getFileName() + " -> " + full);
+                    }
+                }
+            }
+        }
+
+        assertTrue(unguarded.isEmpty(),
+                "以下运营端点未被 SecurityConfig 的 OPERATOR 规则覆盖，"
+                        + "运营账号访问会被 403（管理端对应功能不可用）。"
+                        + "请在 SecurityConfig 的 OPERATOR requestMatchers 中补上其前缀：\n"
+                        + String.join("\n", unguarded));
+    }
+
+    @Test
+    @DisplayName("兜底规则必须是 ROLE_USER，不能退回 authenticated()")
+    void fallbackRuleRequiresUserRole() throws IOException {
+        String cfg = Files.readString(SECURITY_CONFIG);
+        /*
+         * 若兜底退回 authenticated()，运营 token 也算"已认证"，
+         * 于是能打进用户端端点；而 @AuthenticationPrincipal UserPrincipal
+         * 遇 OperatorPrincipal 会返回 null → 未做 null 检查的端点 NPE → 500。
+         * 全仓 244 处使用该注解、仅 48 处做了检查 —— 所以这条兜底不能松。
+         */
+        assertTrue(cfg.contains("hasRole(\"USER\")"),
+                "兜底规则必须是 hasRole(\"USER\")；退回 authenticated() 会让运营身份打进用户端并触发 NPE → 500");
+    }
+
+    // ---------------------------------------------------------------- helpers
+
+    /**
+     * 从 SecurityConfig 源码解析出 **OPERATOR 规则**的路径前缀（去掉结尾的 **）。
+     *
+     * <p>只取与 {@code .hasRole("OPERATOR")} 同一条链的 {@code requestMatchers}。
+     * 这一点必须严格：若把 permitAll 或兜底的 {@code /**} 也收进来，
+     * 任何路径都会被判为"已覆盖"，本测试就变成永远通过的摆设。
+     */
+    private static Set<String> operatorRulePrefixes() throws IOException {
+        String cfg = Files.readString(SECURITY_CONFIG);
+        Set<String> prefixes = new LinkedHashSet<>();
+        Matcher blocks = Pattern.compile(
+                "requestMatchers\\(([^)]*)\\)\\s*\\.hasRole\\(\"OPERATOR\"\\)", Pattern.DOTALL).matcher(cfg);
+        while (blocks.find()) {
+            Matcher literals = Pattern.compile("\"([^\"]+)\"").matcher(blocks.group(1));
+            while (literals.find()) {
+                prefixes.add(literals.group(1));
+            }
+        }
+        return prefixes;
+    }
+
+    private static String firstMappingPath(String src) {
+        Matcher m = Pattern.compile("@RequestMapping\\(\\s*\"([^\"]*)\"").matcher(src);
+        return m.find() ? m.group(1) : "";
+    }
+
+    private static List<String> methodMappingPaths(String src) {
+        List<String> paths = new ArrayList<>();
+        Matcher m = Pattern.compile("@(?:Get|Post|Put|Patch|Delete)Mapping\\(\\s*\"([^\"]*)\"")
+                .matcher(src);
+        while (m.find()) {
+            paths.add(m.group(1));
+        }
+        return paths;
+    }
+
+    private static String join(String classPath, String methodPath) {
+        String base = classPath == null ? "" : classPath;
+        String tail = methodPath == null ? "" : methodPath;
+        String joined = (base + tail).replaceAll("/{2,}", "/");
+        return joined.isEmpty() ? "/" : joined;
+    }
+
+    private static boolean isOperatorPath(String path) {
+        // /auth/operator/** 是运营账号的登录/刷新端点，按设计属于公开或已认证接口，
+        // 由更靠前的 /auth 规则管辖，不应要求 OPERATOR 角色（否则登录本身就进不去）。
+        if (path.startsWith("/auth/")) {
+            return false;
+        }
+        return path.contains("/operator/") || path.startsWith("/operator") || path.equals("/operator");
+    }
+
+    private static boolean isCovered(String fullPath, Set<String> prefixes) {
+        for (String prefix : prefixes) {
+            if (prefix.endsWith("/**")) {
+                String base = prefix.substring(0, prefix.length() - 3);
+                if (fullPath.equals(base) || fullPath.startsWith(base + "/")) {
+                    return true;
+                }
+            } else if (fullPath.equals(prefix)) {
+                return true;
+            }
+        }
+        return false;
+    }
+}