chore: 入库生产基线（2026-10-26 与 shop.douba.top 一致）

- 11 个已跟踪文件的在途改动此前只存在于工作区，生产已在运行
- 补入两个从未入库的文件：InternalController.php（app_03/box_app 内部接口）、
  config/internal.php（内部通信 key，值从 .env 读取，不含硬编码密钥）
- 逐文件 md5 比对过生产，内容一致

Co-authored-by: Cursor <cursoragent@cursor.com>

app/haichao/HaichaoBridge.php

@@ -85,7 +85,7 @@ abstract class HaichaoBridge
         $options['http'] = [
             'timeout' => 60,
             'method' => 'POST',
-            'header' => 'Content-Type: application/json;charset=utf-8',
+            'header' => 'Content-Type: application/x-www-form-urlencoded;charset=UTF-8',
             'content' => http_build_query($baseBody)
         ];
         $raw = file_get_contents("{$this->api['api']}$api", false, stream_context_create($options));
@@ -174,12 +174,24 @@ abstract class HaichaoBridge
 
     private function sign(array $data): string
     {
-        $computerStr = "";
-        foreach ($data as $k => $v) {
-            $computerStr .= $k . $v;
-        }
-        $computerStr = $this->api['appSecret'] . $computerStr;
-        return md5($computerStr);
+        if (!$data) {
+            return '';
+        }
+
+        ksort($data);
+        $str = '';
+        foreach ($data as $k => $v) {
+            if ($k === null || $k === '' || $k === 'sign' || $v === '' || $v === null) {
+                continue;
+            }
+            if (is_array($v) || is_object($v)) {
+                $v = json_encode($v, JSON_UNESCAPED_UNICODE);
+            }
+            $str .= $k . $v;
+        }
+
+        $str = $this->api['appSecret'] . $str;
+        return bin2hex(md5($str, true));
     }
 
     private function isTokenError(array $rt): bool