fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

internal/models/models.go

@@ -1,3 +1,5 @@
+// Modified in the independent hardening fork; see docs/hardening.
+
 package models
 
 import (
@@ -250,6 +252,10 @@ type Customer struct {
 
 // CustomerIdentity 客户第三方身份映射表。
 type CustomerIdentity struct {
+	// Empty scope is legacy/internal integration data; public sessions never fall back to it.
+	IdentityScope string `gorm:"type:varchar(80);not null;default:'';index:idx_customer_identity_scope"`
+	// Nullable for legacy rows; all new public scoped identities claim a unique digest.
+	ScopedKey *string `gorm:"type:varchar(64);uniqueIndex:uk_customer_scoped_key"`
 	ID             int64                `gorm:"primaryKey;autoIncrement"`
 	CustomerID     int64                `gorm:"type:bigint;not null;uniqueIndex:uk_customer_external"`                    // 为所属客户ID。
 	ExternalSource enums.ExternalSource `gorm:"type:varchar(30);uniqueIndex:uk_customer_external"`                        // 为外部身份来源