feat(health): 实现媒体库 handler (12 端点) + 轮播图 handler (6 端点)

媒体库 handler (media_handler.rs):
- 上传/列表/详情/更新/删除媒体文件 + 文件夹 CRUD + 移动 + 裁剪

轮播图 handler (banner_handler.rs):
- 管理端 5 端点（列表/创建/更新/删除/排序）
- 公开端点 1 个（小程序无需认证获取生效轮播图）

crates/erp-health/src/handler/banner_handler.rs

@@ -0,0 +1,142 @@
+use axum::Extension;
+use axum::extract::{FromRef, Json, Path, Query, State};
+
+use erp_core::error::AppError;
+use erp_core::rbac::require_permission;
+use erp_core::types::{ApiResponse, TenantContext};
+
+use crate::dto::banner_dto::{
+    BannerResp, CreateBannerReq, PublicBannerResp, SortBannerReq, UpdateBannerReq,
+};
+use crate::service::banner_service;
+use crate::state::HealthState;
+
+// ---------------------------------------------------------------------------
+// 本地请求结构体
+// ---------------------------------------------------------------------------
+
+#[derive(Debug, serde::Deserialize)]
+pub struct DeleteVersionReq {
+    pub version: i32,
+}
+
+#[derive(Debug, serde::Deserialize)]
+pub struct BannerListQuery {
+    pub status: Option<String>,
+}
+
+#[derive(Debug, serde::Deserialize)]
+pub struct PublicBannerQuery {
+    pub tenant_id: Option<uuid::Uuid>,
+}
+
+// ---------------------------------------------------------------------------
+// 管理端端点
+// ---------------------------------------------------------------------------
+
+/// GET /health/banners — 列出租户所有轮播图
+pub async fn list_banners<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    Query(params): Query<BannerListQuery>,
+) -> Result<Json<ApiResponse<Vec<BannerResp>>>, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.banners.list")?;
+    let result = banner_service::list_banners(&state, ctx.tenant_id, params.status).await?;
+    Ok(Json(ApiResponse::ok(result)))
+}
+
+/// POST /health/banners — 创建轮播图
+pub async fn create_banner<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    mut req: Json<CreateBannerReq>,
+) -> Result<Json<ApiResponse<BannerResp>>, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.banners.manage")?;
+    req.sanitize();
+    let result = banner_service::create_banner(&state, ctx.tenant_id, ctx.user_id, req.0).await?;
+    Ok(Json(ApiResponse::ok(result)))
+}
+
+/// PUT /health/banners/{id} — 更新轮播图
+pub async fn update_banner<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    Path(id): Path<uuid::Uuid>,
+    mut req: Json<UpdateBannerReq>,
+) -> Result<Json<ApiResponse<BannerResp>>, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.banners.manage")?;
+    req.sanitize();
+    let result =
+        banner_service::update_banner(&state, ctx.tenant_id, id, ctx.user_id, req.0).await?;
+    Ok(Json(ApiResponse::ok(result)))
+}
+
+/// DELETE /health/banners/{id} — 软删除轮播图
+pub async fn delete_banner<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    Path(id): Path<uuid::Uuid>,
+    Json(req): Json<DeleteVersionReq>,
+) -> Result<Json<ApiResponse<()>>, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.banners.manage")?;
+    banner_service::delete_banner(&state, ctx.tenant_id, id, ctx.user_id, req.version).await?;
+    Ok(Json(ApiResponse::ok(())))
+}
+
+/// PUT /health/banners/sort — 批量更新排序
+pub async fn sort_banners<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    Json(req): Json<SortBannerReq>,
+) -> Result<Json<ApiResponse<()>>, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.banners.manage")?;
+    banner_service::sort_banners(&state, ctx.tenant_id, req.items).await?;
+    Ok(Json(ApiResponse::ok(())))
+}
+
+// ---------------------------------------------------------------------------
+// 公开端点（小程序 / 无需认证）
+// ---------------------------------------------------------------------------
+
+/// GET /public/banners — 公开轮播图列表
+pub async fn list_public_banners<S>(
+    State(state): State<HealthState>,
+    Query(params): Query<PublicBannerQuery>,
+    headers: axum::http::HeaderMap,
+) -> Result<Json<ApiResponse<Vec<PublicBannerResp>>>, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    // 从 X-Tenant-Id 请求头或查询参数中解析租户 ID
+    let tenant_id = headers
+        .get("X-Tenant-Id")
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.parse::<uuid::Uuid>().ok())
+        .or(params.tenant_id)
+        .ok_or_else(|| AppError::Validation("缺少 tenant_id".to_string()))?;
+
+    let base_url = "http://localhost:3000".to_string();
+    let result = banner_service::list_public_banners(&state, tenant_id, &base_url).await?;
+    Ok(Json(ApiResponse::ok(result)))
+}