feat: 实现分层架构，包含 domain、service、repository 和 pkg 层

- 新增 domain 层：model、provider、route、stats 实体
- 新增 service 层：models、providers、routing、stats 业务逻辑
- 新增 repository 层：models、providers、stats 数据访问
- 新增 pkg 工具包：errors、logger、validator
- 新增中间件：CORS、logging、recovery、request ID
- 新增数据库迁移：初始 schema 和索引
- 新增单元测试和集成测试
- 新增规范文档：config-management、database-migration、error-handling、layered-architecture、middleware-system、request-validation、structured-logging、test-coverage
- 移除 config 子包和 model_router（已迁移至分层架构）

backend/internal/handler/middleware/middleware_test.go

@@ -0,0 +1,130 @@
+package middleware
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/zap"
+)
+
+func init() {
+	gin.SetMode(gin.TestMode)
+}
+
+func TestRequestID_GeneratesUUID(t *testing.T) {
+	r := gin.New()
+	r.Use(RequestID())
+	r.GET("/test", func(c *gin.Context) {
+		id, exists := c.Get(RequestIDKey)
+		assert.True(t, exists)
+		assert.NotEmpty(t, id)
+		c.Status(200)
+	})
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/test", nil)
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, 200, w.Code)
+	assert.NotEmpty(t, w.Header().Get("X-Request-ID"))
+}
+
+func TestRequestID_UsesExistingHeader(t *testing.T) {
+	r := gin.New()
+	r.Use(RequestID())
+	r.GET("/test", func(c *gin.Context) {
+		id, _ := c.Get(RequestIDKey)
+		assert.Equal(t, "existing-id-123", id)
+		c.Status(200)
+	})
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/test", nil)
+	req.Header.Set("X-Request-ID", "existing-id-123")
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, 200, w.Code)
+	assert.Equal(t, "existing-id-123", w.Header().Get("X-Request-ID"))
+}
+
+func TestLogging(t *testing.T) {
+	logger := zap.NewNop()
+
+	r := gin.New()
+	r.Use(Logging(logger))
+	r.GET("/test", func(c *gin.Context) {
+		c.Status(200)
+	})
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/test?key=value", nil)
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, 200, w.Code)
+}
+
+func TestRecovery_NoPanic(t *testing.T) {
+	logger := zap.NewNop()
+
+	r := gin.New()
+	r.Use(Recovery(logger))
+	r.GET("/test", func(c *gin.Context) {
+		c.Status(200)
+	})
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/test", nil)
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, 200, w.Code)
+}
+
+func TestRecovery_WithPanic(t *testing.T) {
+	logger := zap.NewNop()
+
+	r := gin.New()
+	r.Use(Recovery(logger))
+	r.GET("/test", func(c *gin.Context) {
+		panic("test panic")
+	})
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/test", nil)
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, 500, w.Code)
+}
+
+func TestCORS_NormalRequest(t *testing.T) {
+	r := gin.New()
+	r.Use(CORS())
+	r.GET("/test", func(c *gin.Context) {
+		c.Status(200)
+	})
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/test", nil)
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, 200, w.Code)
+	assert.Equal(t, "*", w.Header().Get("Access-Control-Allow-Origin"))
+	assert.Contains(t, w.Header().Get("Access-Control-Allow-Methods"), "GET")
+	assert.Contains(t, w.Header().Get("Access-Control-Allow-Methods"), "POST")
+}
+
+func TestCORS_PreflightRequest(t *testing.T) {
+	r := gin.New()
+	r.Use(CORS())
+	r.OPTIONS("/test", func(c *gin.Context) {
+		c.Status(200)
+	})
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest("OPTIONS", "/test", nil)
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, 204, w.Code)
+	assert.Equal(t, "*", w.Header().Get("Access-Control-Allow-Origin"))
+}