feat: add Yuheng ticket bind, trial SMS off, shared bindings

Ship ticket-exchange and bind/policy for Z13, keep trial binds SMS-free, allow shared company bindings, and align SyncPage plus sync docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

platform/internal/handler/sync_binding.go

@@ -26,6 +26,21 @@ func syncBindingsListHandler(svcCtx *svc.ServiceContext) http.HandlerFunc {
 			list, err = svcCtx.DBSync.Store().ListBindings(tid, localID)
 		} else {
 			list, err = svcCtx.DBSync.Store().ListBindingsFiltered(tid, authx.UserID(r.Context()), localID)
+			if err == nil {
+				// 附带公司共享库 Binding，便于客户端展示
+				all, e2 := svcCtx.DBSync.Store().ListBindings(tid, localID)
+				if e2 == nil {
+					seen := map[string]bool{}
+					for _, b := range list {
+						seen[b.ID] = true
+					}
+					for _, b := range all {
+						if b.Shared && !seen[b.ID] {
+							list = append(list, b)
+						}
+					}
+				}
+			}
 		}
 		if err != nil {
 			authx.WriteError(w, http.StatusBadRequest, err.Error())
@@ -52,8 +67,12 @@ func syncBindingsEnsureHandler(svcCtx *svc.ServiceContext) http.HandlerFunc {
 				body.UserID = uid
 			}
 		} else {
-			// 用户自助：强制绑定到本人，禁止冒用他人 user_id
+			// 用户自助：强制绑定到本人，禁止冒用他人 user_id；禁止自助标共享库
 			body.UserID = uid
+			if body.Shared {
+				authx.WriteError(w, http.StatusForbidden, "仅公司管理员可将 Binding 标为公司共享库（shared）")
+				return
+			}
 		}
 		saved, err := svcCtx.DBSync.Store().EnsureBinding(body)
 		if err != nil {