feat: 企微绑定重构 — 回调事件 + 支局长手动绑定/解绑

绑定流程改为 rural-optical-rectify 方案:
- 企微菜单「绑定账号」发送 click 事件(而非 OAuth 跳转)
- 回调 POST 接收事件 → 生成绑定 token → 推送绑定链接
- 前端 WecomBind.vue (/wecom-bind) 确认绑定
- 新增 POST /api/wecom/bind-confirm (JWT 保护)

支局长手动管理:
- 新增 PUT /api/users/{id}/wecom 绑定/解绑端点
- UserManage.vue 编辑对话框新增企微 UserID 字段
- 表格操作列新增「解绑」按钮
- 重复绑定检测

wecom.py 新增:
- in-memory bind token store (TTL 600s)
- send_text_card() 卡片消息方法
- access_token 属性暴露

Co-Authored-By: Claude <noreply@anthropic.com>

backend/app/services/wecom.py

@@ -1,7 +1,31 @@
 import time
+import uuid
 import httpx
 from app.config import settings
 
+# In-memory bind token store (TTL 600s).  Replace with Redis if scaling to multiple workers.
+_bind_tokens: dict[str, tuple[str, float]] = {}  # token → (wecom_userid, expires_at)
+
+
+def store_bind_token(wecom_userid: str, ttl: int = 600) -> str:
+    """Store a bind token → wecom_userid mapping. Returns the token."""
+    token = uuid.uuid4().hex
+    _bind_tokens[token] = (wecom_userid, time.time() + ttl)
+    # Cleanup expired tokens
+    now = time.time()
+    for k in list(_bind_tokens):
+        if _bind_tokens[k][1] < now:
+            del _bind_tokens[k]
+    return token
+
+
+def consume_bind_token(token: str) -> str | None:
+    """Lookup and consume a bind token. Returns wecom_userid or None."""
+    entry = _bind_tokens.pop(token, None)
+    if entry and entry[1] > time.time():
+        return entry[0]
+    return None
+
 
 class WecomClient:
     """WeChat Work API client — token management, message sending, OAuth."""
@@ -13,9 +37,12 @@ class WecomClient:
         self._access_token: str | None = None
         self._token_expires_at: float = 0  # epoch seconds
 
+    @property
+    def access_token(self) -> str | None:
+        return self._access_token
+
     async def _get_token(self) -> str:
         """Get a valid access token, refreshing if expired."""
-        # Token valid for 7200s; refresh 60s early to be safe
         if self._access_token and time.time() < self._token_expires_at - 60:
             return self._access_token
 
@@ -45,17 +72,14 @@ class WecomClient:
                     if errcode == 0:
                         return data
 
-                    # Token expired mid-request — clear and retry once
                     if errcode == 42001:
                         self._access_token = None
                         self._token_expires_at = 0
                         if attempt < max_retries - 1:
                             continue
 
-                    # Rate limit — wait and retry
                     if errcode == 45009:
                         if attempt < max_retries - 1:
-                            await httpx.AsyncClient().aclose()
                             time.sleep(1 * (attempt + 1))
                             continue
 
@@ -67,6 +91,8 @@ class WecomClient:
 
         raise Exception(f"WeCom API error after {max_retries} retries: {last_error}")
 
+    # ── OAuth ──
+
     async def get_userinfo_by_code(self, code: str) -> dict | None:
         """Exchange OAuth2 code for userid (used in silent login)."""
         try:
@@ -81,6 +107,8 @@ class WecomClient:
         except Exception:
             return None
 
+    # ── Messaging ──
+
     async def send_text_message(self, user_ids: list[str], content: str) -> bool:
         """Send a text app message to specified users."""
         if not settings.WECOM_AGENT_ID:
@@ -117,13 +145,30 @@ class WecomClient:
         except Exception:
             return False
 
+    async def send_text_card(self, user_id: str, title: str, description: str, url: str) -> bool:
+        """Send a textcard message (clickable card) to a single user."""
+        if not settings.WECOM_AGENT_ID:
+            return False
+        try:
+            body = {
+                "touser": user_id,
+                "msgtype": "textcard",
+                "agentid": int(settings.WECOM_AGENT_ID),
+                "textcard": {
+                    "title": title,
+                    "description": description,
+                    "url": url,
+                },
+            }
+            await self._post_with_retry(
+                f"{settings.WECOM_API_BASE}/cgi-bin/message/send", body
+            )
+            return True
+        except Exception:
+            return False
+
     async def send_template_card(
-        self,
-        user_ids: list[str],
-        title: str,
-        desc: str,
-        url: str,
-        btn_text: str = "查看详情",
+        self, user_ids: list[str], title: str, desc: str, url: str, btn_text: str = "查看详情"
     ) -> bool:
         """Send a text_notice template card with a deep-link button."""
         if not settings.WECOM_AGENT_ID:
@@ -136,17 +181,8 @@ class WecomClient:
                 "template_card": {
                     "card_type": "text_notice",
                     "main_title": {"title": title, "desc": desc},
-                    "card_action": {
-                        "type": 1,  # jump to URL
-                        "url": url,
-                    },
-                    "button_list": [
-                        {
-                            "text": btn_text,
-                            "style": 1,  # primary
-                            "key": "open_url",
-                        }
-                ],
+                    "card_action": {"type": 1, "url": url},
+                    "button_list": [{"text": btn_text, "style": 1, "key": "open_url"}],
                 },
             }
             await self._post_with_retry(
@@ -156,18 +192,16 @@ class WecomClient:
         except Exception:
             return False
 
-
     # ── Menu management ──
 
     async def create_menu(self, buttons: list[dict]) -> bool:
-        """Create/replace the app's custom menu (visible in chat window)."""
+        """Create/replace the app's custom menu."""
         if not settings.WECOM_AGENT_ID:
             return False
         try:
             body = {"button": buttons}
             await self._post_with_retry(
-                f"{settings.WECOM_API_BASE}/cgi-bin/menu/create?agentid={settings.WECOM_AGENT_ID}",
-                body,
+                f"{settings.WECOM_API_BASE}/cgi-bin/menu/create?agentid={settings.WECOM_AGENT_ID}", body
             )
             return True
         except Exception: