Operator Surface
Admin API routes are isolated under `/api/v1/admin/*`; user DApp routes stay under `/api/v1/*`.
签到补单是后台受保护写动作，必须先完成管理员登录。