feat(admin): A1 管理后台收敛 Java 单后台完整实现并修复 guard 误拦内部令牌

- Java 补齐后台全部迁移差集:shopduplicatecheck 店铺数据重复检查模块(V108 扫描表+查询/扫描服务)、
  PinyinAbbrUtil 拼音缩写、ImageHistory 接口调整为内部可用、AdminUser 支持内部令牌操作并放宽列表上限
- Flask 后台 admin_api.py 路由收敛转发 Java、admin.html/admin.js 适配新后台形态
- AdminApiGuardFilter 对可信 X-Internal-Token 放行(controller 自校验兜底),修复客户端仅凭
  内部令牌调用 /api/admin/shop-manages/credential 被误拦 401
- 测试:AdminApiGuardFilterTest 补可信/假令牌用例;AdminUserServiceTest 补菜单权限 mock;
  shopduplicatecheck 新增查询/聚合/CSV 单测

backend-java/src/test/java/com/nanri/aiimage/modules/admin/service/AdminUserServiceTest.java

@@ -40,6 +40,7 @@ class AdminUserServiceTest {
         request.setColumnIds(List.of(11L, 12L));
 
         when(authSupport.currentRole(operator)).thenReturn("admin");
+        when(permissionService.hasAnyAdminMenu(eq(operator), any())).thenReturn(true);
         when(passwordEncoder.hash("secret1")).thenReturn("hashed");
         when(userMapper.insert(any(AdminUserEntity.class))).thenAnswer(invocation -> {
             invocation.<AdminUserEntity>getArgument(0).setId(20L);
@@ -73,6 +74,7 @@ class AdminUserServiceTest {
         request.setColumnIds(List.of(21L));
 
         when(authSupport.currentRole(operator)).thenReturn("admin");
+        when(permissionService.hasAnyAdminMenu(eq(operator), any())).thenReturn(true);
         when(userMapper.selectById(20L)).thenReturn(target);
 
         service.updateUser(operator, 20L, request);