DNF90 服务端与启动器完整源码（含 GM 工具功能增强）

服务端（Go）：
- GM 塞背包/带属性装备发放：在线角色推送 op14 增量物品行，背包实时刷新，无需回角色选择界面
- GM 改金币/改等级：去掉在线拒绝，落库后推送 op14 钱包/op37 等级状态，在线实时刷新
- 等级端点统一切换到新版 GMSetCharacterLevel（自带在线刷新）
- 无限/锁死疲劳模式 + 燃烧疲劳：每房间消耗 2 点、打怪与通关经验双倍
- 燃烧疲劳开关时给所有在线角色推送系统提示（op12 mode 0）
- 深渊史诗掉率：GM 全局倍率 + 城镇增益药剂窗口倍率，真实接入掉落结算

启动器（Python/JS）：
- 标题栏自绘、窗口 1204x717、禁止拖拽改大小、仅最小化/关闭
- GM 工具：疲劳与燃烧、深渊史诗掉率、拍卖行上架（单一定价对齐）
- 拍卖行上架前端对齐服务端单一价格语义，修复 400 报错

server/internal/services/logic/admin_policy.go

@@ -0,0 +1,86 @@
+package logic
+
+import (
+	"fmt"
+	"log/slog"
+	"net/http"
+	"strings"
+
+	appkit "longheng.io/server/internal/platform/app"
+	"longheng.io/server/internal/platform/dispatch"
+	"longheng.io/server/internal/platform/httpx"
+	"longheng.io/server/internal/platform/registry"
+)
+
+func logicAdminWrapper(env *appkit.Env, scope string) func(http.HandlerFunc) http.HandlerFunc {
+	if env != nil && env.AdminAuth != nil {
+		return func(next http.HandlerFunc) http.HandlerFunc {
+			return env.AdminAuth(scope, next)
+		}
+	}
+	var logger *slog.Logger
+	if env != nil {
+		logger = env.Logger
+	}
+	return func(next http.HandlerFunc) http.HandlerFunc {
+		return httpx.WrapAdminPolicy(func() httpx.AdminPolicy {
+			return logicAdminPolicy(env)
+		}, logger, scope, next)
+	}
+}
+
+func logicAdminGuard(env *appkit.Env, scope string) func(string, http.HandlerFunc) http.HandlerFunc {
+	if env != nil && env.AdminDangerous != nil {
+		return func(operation string, next http.HandlerFunc) http.HandlerFunc {
+			return env.AdminDangerous(scope, operation, next)
+		}
+	}
+	var logger *slog.Logger
+	if env != nil {
+		logger = env.Logger
+	}
+	return func(operation string, next http.HandlerFunc) http.HandlerFunc {
+		return httpx.WrapDangerousAdminPolicy(func() httpx.AdminPolicy {
+			return logicAdminPolicy(env)
+		}, logger, scope, operation, next)
+	}
+}
+
+func logicAdminPolicy(env *appkit.Env) httpx.AdminPolicy {
+	if env == nil {
+		return httpx.AdminPolicy{}
+	}
+	tokens := make([]httpx.AdminToken, 0, len(env.Config.Admin.Tokens))
+	for _, token := range env.Config.Admin.Tokens {
+		tokens = append(tokens, httpx.AdminToken{
+			Name:   token.Name,
+			Token:  token.Token,
+			Role:   token.Role,
+			Scopes: append([]string(nil), token.Scopes...),
+		})
+	}
+	return httpx.AdminPolicy{
+		Token:               env.Config.Admin.Token,
+		RBACEnabled:         env.Config.Admin.RBACEnabled,
+		RequireConfirmation: env.Config.Admin.DangerousConfirm,
+		Tokens:              tokens,
+	}
+}
+
+func routesFromHandlers(handlers []dispatch.HandlerMeta) []registry.Route {
+	routes := make([]registry.Route, 0, len(handlers))
+	for _, meta := range handlers {
+		if meta.MsgID == 0 {
+			continue
+		}
+		routes = append(routes, registry.Route{
+			ID:         fmt.Sprint(meta.MsgID),
+			Group:      strings.TrimSpace(meta.RouteGroup),
+			Internal:   meta.Internal,
+			Stateful:   meta.Stateful || meta.PlayerScoped,
+			Authorized: meta.Authorized || meta.AuthRequired,
+			Idempotent: meta.Idempotent,
+		})
+	}
+	return routes
+}