fix(auth): ProductOrderController 使用 @RequestAttribute 读取用户ID

修复 JwtInterceptor 设置 response header 但 ProductOrderController 用
@RequestHeader 读取导致的 401 错误。改用 request.setAttribute +
@RequestAttribute 模式，JwtInterceptor 同时设置两处确保兼容性。

zxyj-backend/src/main/java/com/zxyj/config/JwtInterceptor.java

@@ -50,13 +50,11 @@ public class JwtInterceptor implements HandlerInterceptor {
             Long userId = Long.parseLong(claims.getSubject());
             String role = (String) claims.get("role");
 
-            // 将用户信息放入请求属性
-            request.setAttribute("userId", userId);
-            request.setAttribute("role", role);
-
             // 添加自定义请求头，供下游使用
             response.setHeader("X-User-Id", userId.toString());
             response.setHeader("X-User-Role", role);
+            request.setAttribute("userId", userId);
+            request.setAttribute("role", role);
 
             return true;
         } catch (Exception e) {

zxyj-backend/src/main/java/com/zxyj/controller/product/ProductOrderController.java

@@ -6,9 +6,9 @@ import com.zxyj.dto.ProductOrderDTO;
 import com.zxyj.service.ProductOrderService;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestHeader;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.bind.annotation.RequestAttribute;
 
 import javax.annotation.Resource;
 import java.util.List;
@@ -23,48 +23,48 @@ public class ProductOrderController {
 
     @PostMapping("/create")
     public Result<ProductOrderDTO> create(@RequestBody CreateProductOrderDTO dto,
-                                         @RequestHeader(value = "X-User-Id", required = false) Long userId) {
+                                         @RequestAttribute("userId") Long userId) {
         return orderService.create(dto, userId);
     }
 
     @PostMapping("/pay")
     public Result<ProductOrderDTO> pay(@RequestBody Map<String, Object> params,
-                                      @RequestHeader(value = "X-User-Id", required = false) Long userId) {
+                                      @RequestAttribute("userId") Long userId) {
         String orderNo = (String) params.get("orderNo");
         return orderService.pay(orderNo, userId);
     }
 
     @PostMapping("/cancel")
     public Result<String> cancel(@RequestBody Map<String, Object> params,
-                                @RequestHeader(value = "X-User-Id", required = false) Long userId) {
+                                @RequestAttribute("userId") Long userId) {
         String orderNo = (String) params.get("orderNo");
         return orderService.cancel(orderNo, userId);
     }
 
     @PostMapping("/my")
     public Result<List<ProductOrderDTO>> myOrders(@RequestBody Map<String, Object> params,
-                                                 @RequestHeader(value = "X-User-Id", required = false) Long userId) {
+                                                 @RequestAttribute("userId") Long userId) {
         String status = (String) params.get("status");
         return orderService.myOrders(userId, status);
     }
 
     @PostMapping("/detail")
     public Result<ProductOrderDTO> detail(@RequestBody Map<String, Object> params,
-                                        @RequestHeader(value = "X-User-Id", required = false) Long userId) {
+                                        @RequestAttribute("userId") Long userId) {
         String orderNo = (String) params.get("orderNo");
         return orderService.detail(orderNo, userId);
     }
 
     @PostMapping("/vendor")
     public Result<List<ProductOrderDTO>> vendorOrders(@RequestBody Map<String, Object> params,
-                                                     @RequestHeader(value = "X-User-Id", required = false) Long userId) {
+                                                     @RequestAttribute("userId") Long userId) {
         String status = (String) params.get("status");
         return orderService.vendorOrders(userId, status);
     }
 
     @PostMapping("/confirm")
     public Result<String> confirm(@RequestBody Map<String, Object> params,
-                                 @RequestHeader(value = "X-User-Id", required = false) Long userId) {
+                                 @RequestAttribute("userId") Long userId) {
         String orderNo = (String) params.get("orderNo");
         return orderService.confirm(orderNo, userId);
     }