v0.1.0: CRM/ERP 系统内测版本 - 安全加固完成

- Docker bridge 网络隔离（8000 端口封死）
- Gunicorn 4 Worker 多进程
- Alembic 数据库迁移基线
- 日志轮转 20m×3
- JWT 密钥 + DB 密码 + CORS 收紧
- 3-2-1 备份链路（NAS + R740-B 冷备）
- 连接池 pool_pre_ping + pool_recycle=3600

server/app/api/contacts.py

@@ -0,0 +1,72 @@
+"""
+联系人 API 路由 — /api/customers/{cid}/contacts & /api/contacts/{id}
+V5.0: 实现客户下联系人的完整 CRUD
+"""
+from __future__ import annotations
+
+import uuid
+from fastapi import APIRouter, Depends, Body
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.api.deps import get_current_user
+from app.db.database import get_db
+from app.schemas.auth import CurrentUserPayload
+from app.schemas.response import ok
+from app.services import contact_service
+
+router = APIRouter(tags=["联系人"])
+
+
+@router.get("/customers/{customer_id}/contacts", summary="列出客户下所有联系人")
+async def list_contacts(
+    customer_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db),
+    _: CurrentUserPayload = Depends(get_current_user),
+) -> dict:
+    items = await contact_service.list_contacts(db, customer_id)
+    return ok(data=items)
+
+
+@router.post("/customers/{customer_id}/contacts", summary="新增联系人")
+async def create_contact(
+    customer_id: uuid.UUID,
+    name: str = Body(..., embed=True),
+    phone: str | None = Body(None, embed=True),
+    title: str | None = Body(None, embed=True),
+    db: AsyncSession = Depends(get_db),
+    _: CurrentUserPayload = Depends(get_current_user),
+) -> dict:
+    result = await contact_service.create_contact(
+        db, customer_id, {"name": name, "phone": phone, "title": title}
+    )
+    return ok(data=result, message="联系人创建成功")
+
+
+@router.put("/contacts/{contact_id}", summary="编辑联系人")
+async def update_contact(
+    contact_id: uuid.UUID,
+    name: str | None = Body(None, embed=True),
+    phone: str | None = Body(None, embed=True),
+    title: str | None = Body(None, embed=True),
+    db: AsyncSession = Depends(get_db),
+    _: CurrentUserPayload = Depends(get_current_user),
+) -> dict:
+    data = {}
+    if name is not None:
+        data["name"] = name
+    if phone is not None:
+        data["phone"] = phone
+    if title is not None:
+        data["title"] = title
+    result = await contact_service.update_contact(db, contact_id, data)
+    return ok(data=result, message="联系人更新成功")
+
+
+@router.delete("/contacts/{contact_id}", summary="删除联系人 (软删除)")
+async def delete_contact(
+    contact_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db),
+    _: CurrentUserPayload = Depends(get_current_user),
+) -> dict:
+    await contact_service.delete_contact(db, contact_id)
+    return ok(message="联系人已删除")