[Audit 2026-04-14] Docs-implementation divergence tracking

[yanghao1143]

Summary

Workspace docs and implementation diverge on routes, APIs, permissions, and feature coverage.

Findings

• confirmed docs describe gateway-svc as integrated, but compose/services do not include it.
  • Evidence: docs 04-API接口文档.md:326, 11-网关路由配置.md:127,139; code docker-compose.ms.yml service list
• confirmed docs claim 7 gateway routes, but current route yaml lacks several documented routes.
  • Evidence: docs 11-网关路由配置.md:131-134; code sys/api/gateway.yaml:47-90
• confirmed docs define Platform/Merchant/Agent frontends, but frontend routes are missing.
  • Evidence: docs 04-API接口文档.md:429-452; code kit-frontend/config/routes.ts
• confirmed docs define gateway/platform/merchant/agent permission namespace, but permission/menu definitions do not.
  • Evidence: docs 04-API接口文档.md:459-466; code sys/menu/menu.yaml, sys/api/permission.yaml
• confirmed WeChat auth endpoint paths differ between docs and proto definitions.
  • Evidence: docs 04-API接口文档.md:288-289; code user/api/auth/v1/idp.proto:18,25
• confirmed docs mark WeChat login APIs as unauthenticated, while frontend SDK injects Authorization.
  • Evidence: docs 04-API接口文档.md:288-289; code kit-frontend/packages/api/api/we-chat-auth-service-api.ts:60,98
• confirmed docs present subscription management separately, but frontend route reuses order page/api.
  • Evidence: docs 04-API接口文档.md:146-162; code kit-frontend/config/routes.ts:114, kit-frontend/src/pages/Order/Order/index.tsx

Suggested Direction

• Define single source of truth for API/route/permission contracts.
• Add CI checks for docs vs proto/openapi vs frontend SDK drift.