feat(songs): 歌曲管理支持批量驳回、投稿留言自动审查与排期范围可见性过滤

- 新增 /api/admin/songs/batch-reject.post 批量驳回接口（事务清排期/投票/扣接纳数/黑名单去重/异步通知）
- requireSongAdmin 三角色校验 + createApiError 统一错误包装
- scheduleDaysBefore/After 四字段排期可见范围限制（开放 API 与公开排期接口三处缓存路径 + DB 条件过滤）
- submissionNoteAutoModeration 基于黑名单 KEYWORD/LANGUAGE/GENRE 自动判定留言 publicStatus，命中自动关闭 submissionNotePublic
- 更新 songs/request.post 与 songs/[id]/update.put 接入自动审查逻辑

server/utils/card-code-delete-handler.ts

@@ -0,0 +1,68 @@
+import { createError, getQuery, readBody } from 'h3'
+import { z } from 'zod'
+import { deleteCardCodesByIds } from '~~/server/services/cardCodeDeleteService'
+
+const MAX_DELETE_COUNT = 500
+const idSchema = z.preprocess(
+  (value) => (typeof value === 'number' || typeof value === 'string' ? value : undefined),
+  z.coerce.number().int().positive()
+)
+
+const deleteCardCodesSchema = z.object({
+  id: idSchema.optional(),
+  ids: z.preprocess(
+    (value) => {
+      if (typeof value === 'string') {
+        return value.split(',').map((item) => item.trim()).filter(Boolean)
+      }
+      return value
+    },
+    z.array(idSchema).max(MAX_DELETE_COUNT, `单次最多删除 ${MAX_DELETE_COUNT} 个点歌券`).optional()
+  )
+})
+
+export const handleOpenCardCodeDelete = async (event: any) => {
+  const apiKey = event.context.apiKey
+  if (!apiKey) {
+    throw createError({ statusCode: 401, message: 'API认证失败' })
+  }
+
+  try {
+    const query = getQuery(event)
+    const body = await readBody(event).catch(() => ({})) ?? {}
+    const validatedData = deleteCardCodesSchema.parse({ ...query, ...body })
+    const rawIds = [
+      ...(validatedData.id !== undefined ? [validatedData.id] : []),
+      ...(validatedData.ids || [])
+    ]
+    const ids = Array.from(new Set(rawIds))
+
+    if (!ids.length) {
+      throw createError({ statusCode: 400, message: '缺少有效点歌券ID' })
+    }
+    if (ids.length > MAX_DELETE_COUNT) {
+      throw createError({ statusCode: 400, message: `单次最多删除 ${MAX_DELETE_COUNT} 个点歌券` })
+    }
+
+    const deletedRows = await deleteCardCodesByIds(ids)
+    return {
+      success: true,
+      message: '点歌券删除成功',
+      data: {
+        cardCodes: deletedRows,
+        deleted: deletedRows.length,
+        requested: ids.length
+      }
+    }
+  } catch (err: any) {
+    if (err.statusCode) throw err
+    if (err.name === 'ZodError') {
+      throw createError({
+        statusCode: 400,
+        message: `请求参数验证失败：${(err.issues || err.errors).map((issue: any) => issue.message).join(', ')}`
+      })
+    }
+    console.error('开放API删除点歌券失败', err)
+    throw createError({ statusCode: 500, message: '删除点歌券失败' })
+  }
+}