feat: 公开首页(搜索+商品详情) + 好心人投稿 + 后台审核收纳

- 公开前端 SPA（根路径 /）：首页大搜索框、检索结果、只读商品详情、贡献档案表单
- 公开写入端点 POST /api/public/submissions（无需登录，基础频率限流），投稿进入 submission 待审核队列，不直接写 product
- 迁移 0006：submission 投稿表 + community 来源(trust=0.50)
- 后台审核队列：列表(待审核/已通过/已驳回) → 查看投稿 → 通过(创建/补全商品 + 记 source=community + 字段级溯源 + 审计 + 重算质量分) / 驳回(记原因)
- 公开只读 api 服务内嵌公开 SPA；Dockerfile.prod 增加 node 构建阶段 + 内嵌 dist

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

admin-frontend/src/api.ts

@@ -90,4 +90,23 @@ export const api = {
     request<{ items: import("./types").Brand[] }>("/brands"),
   listCategories: () =>
     request<{ items: import("./types").Category[] }>("/categories"),
+  listSubmissions: (status: string, page: number, size: number) =>
+    request<{
+      items: import("./types").SubmissionRow[];
+      page: number;
+      size: number;
+      total: number;
+      pending: number;
+    }>(`/submissions?status=${encodeURIComponent(status)}&page=${page}&size=${size}`),
+  getSubmission: (id: string) =>
+    request<import("./types").SubmissionDetail>(`/submissions/${id}`),
+  approveSubmission: (id: string) =>
+    request<import("./types").ProductDetail>(`/submissions/${id}/approve`, {
+      method: "POST",
+    }),
+  rejectSubmission: (id: string, note: string) =>
+    request<{ status: string }>(`/submissions/${id}/reject`, {
+      method: "POST",
+      body: JSON.stringify({ note }),
+    }),
 };