feat(tender): 阶段3b 企业登录/注册 + 购买→支付→确认 闭环

- useHjcAuth：token 存 cookie(hjc_token)，login/register/isLoggedIn
- 页面 /login /register（企业名称+密码）
- server/api/tender/{auth/login,auth/register,pay,mark-paid} 代理；order 代理从 cookie 读取 hjc_token 透传 Authorization
- BuyDocument：未登录跳登录；下单→pay(codeUrl)→确认 mark-paid→成功
- types 增 HjcUser

server/api/tender/pay.post.ts

@@ -0,0 +1,37 @@
+import { $fetch } from 'ofetch'
+import { createError, defineEventHandler, readBody, getHeader, getCookie } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import { getTenantFromContext } from '../../utils/tenant'
+
+/**
+ * 发起支付（微信Native扫码，返回 codeUrl）
+ * POST /api/tender/pay { orderNo }
+ * 代理到 mp-api /api/hjc/order/pay；需登录态。
+ */
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig()
+  const ctx = getTenantFromContext(event, config)
+  const body = await readBody(event)
+  const cookieToken = getCookie(event, 'hjc_token')
+  const auth = getHeader(event, 'authorization') || (cookieToken ? `Bearer ${cookieToken}` : null)
+
+  try {
+    const res = await $fetch('/hjc/order/pay', {
+      baseURL: config.public.modulesApiBase,
+      method: 'POST',
+      headers: {
+        TenantId: ctx.tenantId,
+        ...(auth ? { Authorization: auth } : {})
+      },
+      query: { TenantId: ctx.tenantId },
+      body
+    }) as any
+    const data = res && res.data !== undefined ? res.data : res
+    return data
+  } catch (error: any) {
+    throw createError({
+      statusCode: error?.statusCode || error?.response?.status || 502,
+      statusMessage: error?.statusMessage || 'Failed to pay'
+    })
+  }
+})