feat(M4): 生命周期 + 审计 — 到期锁定/回收 cron、审计查询/CSV 导出/每日归档、settings 动态策略

internal/api/user.go

@@ -179,21 +179,14 @@ func (h *UserHandler) Extend(c *gin.Context) {
 		fail(c, http.StatusNotFound, err.Error())
 		return
 	}
-	if err := h.svc.Extend(c.Request.Context(), uint(id), req.Days); err != nil {
+	newExpire, err := h.svc.Extend(c.Request.Context(), uint(id), req.Days)
+	if err != nil {
 		h.h.audit(c, "user.extend", "user", c.Param("id"), map[string]any{"days": req.Days, "err": err.Error()}, model.ResultFailed)
 		fail(c, http.StatusInternalServerError, err.Error())
 		return
 	}
 	h.h.audit(c, "user.extend", "user", c.Param("id"), map[string]any{"days": req.Days, "old_status": u.Status}, model.ResultSuccess)
-	ok(c, gin.H{"expire_at": time.Now().Add(h.extendTTL(req.Days)).UTC()})
-}
-
-// extendTTL 计算新的有效期（与 service 保持一致：days<=0 用默认）。
-func (h *UserHandler) extendTTL(days int) time.Duration {
-	if days <= 0 {
-		return h.cfg.Policy.DefaultTTL
-	}
-	return time.Duration(days) * 24 * time.Hour
+	ok(c, gin.H{"expire_at": newExpire.UTC()})
 }
 
 // Delete DELETE /users/:id —— 删除并回收（系统账号 + 家目录 + 密钥，保留审计）。