fix(security): reapply API authorization hardening

[JnyRoad]

Summary

• Reapplies the full API authentication, authorization, and PII hardening from PR fix(security): harden staff PII access and internal routes #152 and its direct follow-up.
• Reapplies PR fix(security): add verified door lock compatibility #154 verified legacy DoorLock compatibility, which depends on the same authorization model.
• Restores the exact pre-PR-157 tree while preserving unrelated PR fix(ops): guard release restart flow #155 release guards and PR docs(h5): remove tracked door lock design artifacts #156 documentation cleanup.
• This is a new, intentionally open replacement PR; it does not merge automatically.

Validation

• smart: mvn -q -DskipTests clean install -Dmaven.repo.local=... passed after installing the matching current smart-platform-api artifact.
• smart-module: mvn -q -DskipTests clean compile -Dmaven.repo.local=... passed.
• smart-h5: pnpm check and pnpm test passed (60 files, 273 tests).
• smart-ui: pnpm test passed (79 files, 398 tests).
• smart-app-uniapp: password challenge race and leave current-park contract scripts passed.
• scripts/security: 2 Node tests passed.

Known validation limits

• smart-h5 production build requires NEXT_PUBLIC_SECURITY_ENCODE_KEY, which is not available in this isolated checkout.
• smart-ui lint has one pre-existing error at src/views/admin/social/index.vue:169 plus existing warnings; that file is not changed by this PR.
• No production deployment or live DoorLock integration test was performed.

Risks

This reintroduces a broad security change across service routes, clients, Nacos templates, and legacy DoorLock compatibility. Recheck runtime configuration and complete integrated testing before merging.