feat(matchmaker,contactauth): 受控联系授权机制立项落地（OQ-MATCHMAKER-003 / DEC-MATCHMAKER-003 B1 例外通道）

后端：
- V056 matchmaker_contact_authorizations 表：channel CHECK(phone/offline_meeting/full_contact)、六态状态机(pending_approval→pending_consent→active→expired/revoked, →rejected)、部分唯一索引 uq_mm_contact_auth_active 防同红娘-同用户-同渠道多 ACTIVE、双态惰性收敛(active 过期 + pending_consent 超同意窗口)
- ContactAuthorizationConfig 五 canonical key(matchmaker.contact.*)：enabled 代码缺省 false fail-safe(yml 显式 true)/approver-authorities 双岗并列/consent-deadline-hours 72/default-validity-days 7/retention-days 365，全部 DEFAULT+CONFIG 待产品+法务终审
- ContactAuthorizationPolicy.assertContactAllowed(404 化 deny 先审计后 404) + canContact 徽标查询
- ContactAuthorizationService：request(须有效分配+purpose 必填)/approve(权限码动态判定∈配置+组长组织范围)/consent(用户本人,仅 pending_consent)/decline/revoke(reason 必填)/disclose(唯一披露出口：enabled fail-safe→assertActiveAssignment→assertContactAllowed→仅返回 phone/disclosedAt/authorizationId 三键，每次落 SensitiveAccessLog user_phone_disclosure，phone 不落应用日志)
- 双控制器：运营端 /operator/matchmaker/contact-authorizations + C 端 /contact-authorizations(UserPrincipal 归属校验,独立端点无预同意参数)，不碰 SecurityConfig

守卫翻转（机械锁强制复审机制按设计生效）：
- MatchmakerContactGuardTest 由「锁不存在」翻转为「锁新契约」五条：回显白名单类收敛/端点前缀收敛(受治理三包)/到期语义/consent 独立性三端扫描(后端+miniapp+admin-web,修复原只扫后端的预同意参数逃逸缺口)/ReferralService 白名单与无 @Scheduled 保留
- run-backend-contracts CURATED 18→20

前端：
- miniapp 新页 pages/contact-consent(目的/渠道/窗口明示+独立同意拒绝按钮无预勾选,app.json 第 64 页) + 红娘工作台申请/列表/撤销
- admin-web「联系授权审批」tab(审批岗队列+本人授权撤销,枚举码中文映射)

验证：mvn verify 895/895(3 skip)、UI 契约 24/24(64 页)、后端契约门禁 228/CURATED 20、小程序真编译 87 WXML 0 失败；负向注入 5(工程师)+2(QA 不同落点)判红→还原复绿；QA 抓 disclose 键数收敛断言缺口已补并回归；QA fresh eyes PASS 0 P0/P1

admin-web/src/modules/matchmaker/MatchmakerManagementView.vue

@@ -66,6 +66,36 @@
             </el-table-column>
           </el-table>
         </el-tab-pane>
+        <!-- ZC-MM-003 / B1 立项：受控联系授权（审批岗队列 + 本人授权/撤销） -->
+        <el-tab-pane label="联系授权审批" name="contactAuths">
+          <el-table :data="contactAuths" stripe v-loading="contactAuthsLoading">
+            <el-table-column prop="operatorId" label="红娘ID" width="120" />
+            <el-table-column prop="userId" label="用户ID" width="120" />
+            <el-table-column prop="channel" label="渠道" width="110">
+              <template #default="{ row }">{{ contactChannelLabel(row.channel) }}</template>
+            </el-table-column>
+            <el-table-column prop="purpose" label="授权目的" show-overflow-tooltip />
+            <el-table-column prop="status" label="状态" width="110">
+              <template #default="{ row }"><el-tag :type="contactStatusTag(row.status)">{{ contactStatusLabel(row.status) }}</el-tag></template>
+            </el-table-column>
+            <el-table-column prop="createdAt" label="申请时间" width="170">
+              <template #default="{ row }">{{ formatDateTime(row.createdAt) }}</template>
+            </el-table-column>
+            <el-table-column prop="expiresAt" label="窗口/有效期至" width="170">
+              <template #default="{ row }">{{ formatDateTime(row.expiresAt) }}</template>
+            </el-table-column>
+            <el-table-column label="操作" width="220">
+              <template #default="{ row }">
+                <template v-if="row.status === 'pending_approval' && canApprove">
+                  <el-button size="small" type="primary" @click="doContactApprove(row)">批准</el-button>
+                  <el-button size="small" type="danger" @click="doContactReject(row)">拒绝</el-button>
+                </template>
+                <el-button v-if="['active','pending_approval','pending_consent'].includes(row.status)"
+                  size="small" @click="doContactRevoke(row)">撤销</el-button>
+              </template>
+            </el-table-column>
+          </el-table>
+        </el-tab-pane>
       </el-tabs>
     </el-card>
 
@@ -136,7 +166,7 @@
 <script setup lang="ts">
 import { ref, computed, onMounted } from 'vue'
 import { get, post } from '@/api/client'
-import { ElMessage } from 'element-plus'
+import { ElMessage, ElMessageBox } from 'element-plus'
 import { useAuthStore } from '@/stores/auth'
 
 const authStore = useAuthStore()
@@ -192,6 +222,19 @@ const ASSIGNMENT_STATUS_TAG: Record<string, string> = {
   active: 'success', ended: 'info', revoked: 'danger', transferred: 'info', expired: 'info'
 }
 
+// ===== ZC-MM-003 / B1：受控联系授权（枚举码不上屏，中文映射） =====
+const CONTACT_CHANNEL_LABEL: Record<string, string> = {
+  phone: '电话联系', offline_meeting: '线下见面', full_contact: '完整联系方式'
+}
+const CONTACT_STATUS_LABEL: Record<string, string> = {
+  pending_approval: '待审批', pending_consent: '待用户确认', active: '生效中',
+  rejected: '已拒绝', expired: '已过期', revoked: '已撤销'
+}
+const CONTACT_STATUS_TAG: Record<string, string> = {
+  pending_approval: 'warning', pending_consent: 'warning', active: 'success',
+  rejected: 'danger', expired: 'info', revoked: 'info'
+}
+
 function serviceTypeLabel(t: string) { return SERVICE_TYPE_LABEL[t] || t }
 function statusLabel(s: string) { return STATUS_LABEL[s] || s }
 function statusTag(s: string) { return STATUS_TAG[s] || 'info' }
@@ -201,6 +244,45 @@ function assignmentStatusLabel(s: string) { return ASSIGNMENT_STATUS_LABEL[s] ||
 function assignmentStatusTag(s: string) { return ASSIGNMENT_STATUS_TAG[s] || 'info' }
 function assignmentScopeLabel(s: string) { return s === 'primary' ? '主责' : '协同' }
 function formatDateTime(d: string) { return d ? new Date(d).toLocaleString('zh-CN') : '-' }
+function contactChannelLabel(s: string) { return CONTACT_CHANNEL_LABEL[s] || s }
+function contactStatusLabel(s: string) { return CONTACT_STATUS_LABEL[s] || s }
+function contactStatusTag(s: string) { return CONTACT_STATUS_TAG[s] || 'info' }
+
+// ===== ZC-MM-003 / B1：受控联系授权 =====
+// 审批岗客户端可见性提示（真实判定在 Service 层动态执行：principal 权限 ∈ approver-authorities 配置）
+const canApprove = computed(() => {
+  const perms: string[] = authStore.permissions || []
+  return perms.includes('matchmaker.assign') || perms.includes('matchmaker.team.assign')
+})
+const contactAuths = ref<any[]>([])
+const contactAuthsLoading = ref(false)
+
+async function loadContactAuths() {
+  contactAuthsLoading.value = true
+  try { const res: any = await get('/operator/matchmaker/contact-authorizations/my'); contactAuths.value = res?.data?.list || [] } finally { contactAuthsLoading.value = false }
+}
+async function doContactApprove(row: any) {
+  try {
+    await post(`/operator/matchmaker/contact-authorizations/${row.id}/approve`, {})
+    ElMessage.success('已批准，等待用户单独确认'); loadContactAuths()
+  } catch (e: any) { ElMessage.error(e?.response?.data?.message || '操作失败') }
+}
+async function doContactReject(row: any) {
+  try {
+    await post(`/operator/matchmaker/contact-authorizations/${row.id}/reject`, {})
+    ElMessage.success('已拒绝'); loadContactAuths()
+  } catch (e: any) { ElMessage.error(e?.response?.data?.message || '操作失败') }
+}
+async function doContactRevoke(row: any) {
+  try {
+    const { value } = await ElMessageBox.prompt('撤销理由（必填）', '撤销联系授权', {
+      confirmButtonText: '确认撤销', cancelButtonText: '取消',
+      inputValidator: (v: string) => (v && v.trim() ? true : '撤销理由必填'),
+    })
+    await post(`/operator/matchmaker/contact-authorizations/${row.id}/revoke`, { reason: value.trim() })
+    ElMessage.success('已撤销'); loadContactAuths()
+  } catch { /* 用户取消 */ }
+}
 
 async function loadServices() {
   loading.value = true
@@ -226,6 +308,7 @@ async function loadAssignableMatchmakers() {
 async function refresh() {
   if (activeTab.value === 'services') await loadServices()
   else if (activeTab.value === 'assignments') await loadAssignments()
+  else if (activeTab.value === 'contactAuths') await loadContactAuths()
   else await loadRecommendations()
 }