commit a4aa749cc61863551bb7d1ef08ff88242a032f6a
Author: Vicky <10212746+haifeng-jiang@user.noreply.gitee.com>
Date:   Wed Oct 14 18:02:47 2026 +0800

    feat: 初始化短剧服务端（管理后台 API + 客户端 API）
    
    Spring Boot 3.2 / MyBatis-Plus / PostgreSQL，7 个 Maven 模块；含认证鉴权、内容与媒资管理、操作日志，以及客户端 /app/** 接口。

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..77cf8a9
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,18 @@
+# 构建产物
+target/
+
+# IDE / 编辑器
+.idea/
+*.iml
+.vscode/
+
+# 系统文件
+.DS_Store
+
+# 日志
+*.log
+logs/
+
+# 运行期上传的媒资（图片、视频，几百 MB）不入库，只保留目录
+data/uploads/*
+!data/uploads/.gitkeep
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..aca883d
--- /dev/null
+++ b/README.md
@@ -0,0 +1,320 @@
+# ReelShort 短剧服务（后端）
+
+短剧服务的服务端，Spring Boot + PostgreSQL，目前实现管理后台接口（`/admin/**`）。
+完整架构设计与迭代计划见 [docs/architecture-design.md](docs/architecture-design.md)。
+
+| 项 | 版本 |
+| --- | --- |
+| 运行时 | JDK 21（LTS），编译目标 Java 17 |
+| 框架 | Spring Boot 3.2.5、Spring Security 6、MyBatis-Plus 3.5.7 |
+| 数据库 | PostgreSQL 18 |
+| 构建 | Maven 3.10 多模块 |
+
+## 目录结构
+
+```
+java/
+├── reelshort-common/          统一响应、分页、错误码、业务异常
+├── reelshort-framework/       JWT 鉴权、权限校验、全局异常、MyBatis-Plus、CORS
+├── reelshort-module-system/   管理员、角色、权限、菜单、角色分类、配置、操作日志
+├── reelshort-module-content/  短剧、剧集、题材、审核发布
+├── reelshort-admin-api/       启动模块与 /admin/** 控制器
+├── sql/                       schema.sql 建表、data.sql 初始化数据
+└── docs/                      架构设计文档
+```
+
+## 开发环境
+
+本机环境由 Homebrew 统一管理（版本以本机实际安装为准）：
+
+| 组件 | 版本 | 说明 |
+| --- | --- | --- |
+| Homebrew | 7.0.9 | 远端指向清华镜像，见文末常见问题 |
+| JDK | OpenJDK 21.0.12.1 | `brew install openjdk@21`，`JAVA_HOME` 已写入 `~/.zshrc` |
+| Maven | 3.10.0 | `brew install maven`，命令为 `/opt/homebrew/bin/mvn` |
+| PostgreSQL | 18.6 | `brew install postgresql@18`，`brew services start postgresql@18` 启动 |
+
+> `postgresql@18` 是 keg-only，命令行工具在 `/opt/homebrew/opt/postgresql@18/bin`，
+> 用之前把它加到 PATH：`export PATH="/opt/homebrew/opt/postgresql@18/bin:$PATH"`。
+
+```sh
+java -version   # openjdk 21.0.12.1
+mvn -v          # Maven 3.10.0 / Java 21.0.12.1
+```
+
+说明：
+
+- 工程编译目标为 Java 17（`maven.compiler.release=17`），在 JDK 21 上构建与运行。
+- 父 POM 显式声明了注解处理器（`<proc>full</proc>` + `annotationProcessorPaths`）：
+  JDK 23 起不再默认扫描 classpath 上的处理器，缺这段配置 Lombok 会失效。
+- 旧的 JDK 18 仍留在 `/Library/Java/JavaVirtualMachines/jdk-18.0.2.jdk`，删除需要 sudo，
+  不影响使用（`java_home` 与 `JAVA_HOME` 都已指向 21）。
+
+## 快速开始
+
+服务有两个入口，可以只启动其中一个：
+
+| 服务 | 模块 | 端口 | 面向 |
+| --- | --- | --- | --- |
+| 管理端 | `reelshort-admin-api` | 8080 | Vue 后台 |
+| 客户端 | `reelshort-app-api` | 8081 | Flutter 客户端 |
+
+### 1. 初始化数据库
+
+```sh
+export PATH="/opt/homebrew/opt/postgresql@18/bin:$PATH"
+cd /Users/jianghaifeng/Desktop/ReelShort/FruitServer
+psql -h 127.0.0.1 -U reelshort -d reelshort -f sql/schema.sql
+psql -h 127.0.0.1 -U reelshort -d reelshort -f sql/data.sql
+```
+
+数据库名 `reelshort`，角色 `reelshort`（密码 `reelshort`），两个脚本都可重复执行。
+首次搭建环境时先建角色与库：
+
+```sh
+psql -d postgres -c "CREATE ROLE reelshort LOGIN PASSWORD 'reelshort';"
+psql -d postgres -c "CREATE DATABASE reelshort OWNER reelshort ENCODING 'UTF8';"
+```
+
+连接信息在
+`reelshort-admin-api/src/main/resources/application.yml`，可用环境变量
+`DB_USER` / `DB_PASSWORD` / `JWT_ADMIN_SECRET` 覆盖。
+
+### 关于 PostgreSQL 的两点说明
+
+- 自增列用 `GENERATED BY DEFAULT AS IDENTITY`；`sql/data.sql` 里用了显式 ID，
+  脚本末尾会把序列 `setval` 到当前最大值，新增数据不会主键冲突。
+- PostgreSQL 没有 `ON UPDATE CURRENT_TIMESTAMP`，`updated_at` 由 `set_updated_at()`
+  触发器统一维护（见 `sql/schema.sql` 末尾），实体侧仍不参与更新该字段。
+- 轮播图的展示位置列名叫 `slot`（`position` 在 PostgreSQL 里是关键字），
+  实体用 `@TableField("slot")` 映射，对外接口字段仍是 `position`，前端无需改动。
+
+### 2. 构建
+
+```sh
+cd /Users/jianghaifeng/Desktop/ReelShort/FruitServer
+mvn -DskipTests package
+```
+
+### 3. 启动
+
+```sh
+cd /Users/jianghaifeng/Desktop/ReelShort/FruitServer
+java -jar reelshort-admin-api/target/reelshort-admin-api-1.0.0-SNAPSHOT.jar
+java -jar reelshort-app-api/target/reelshort-app-api-1.0.0-SNAPSHOT.jar
+```
+
+启动后：服务地址 `http://localhost:8080`，接口文档 `http://localhost:8080/doc.html`。
+
+## 默认账号
+
+密码均为 `admin123`。
+
+| 账号 | 角色 | 权限范围 |
+| --- | --- | --- |
+| admin | 超级管理员 | 全部 14 项权限 |
+| content.editor01 | 内容运营 | 短剧、剧集的增删改与封面上传 |
+| content.reviewer01 | 审核专员 | 查看内容、审核发布、数据报表 |
+| data.analyst01 | 数据分析师 | 查看短剧列表与数据报表 |
+
+## 接口一览
+
+### 认证 `/admin/auth`
+
+| 方法 | 路径 | 说明 |
+| --- | --- | --- |
+| POST | `/login` | 登录，返回 token 与权限码 |
+| GET | `/menus` | 当前用户菜单路由树（前端动态路由） |
+| GET | `/profile` | 当前登录人信息 |
+| POST | `/logout` | 登出（JWT 无状态，前端清除 token 即可） |
+| POST | `/password` | 修改自己的密码 |
+
+### 后台管理
+
+| 模块 | 接口 |
+| --- | --- |
+| 管理员 | `GET /admin/admin-users/page`、`POST /admin/admin-users`、`PUT\|DELETE /admin/admin-users/{id}`、`PUT /{id}/status`、`PUT /{id}/password` |
+| 角色 | `GET /admin/roles/page`、`GET /admin/roles/list`、`POST /admin/roles`、`PUT\|DELETE /admin/roles/{id}`、`GET\|PUT /admin/roles/{id}/permissions` |
+| 角色分类 | `GET\|POST /admin/role-categories`、`PUT\|DELETE /admin/role-categories/{id}` |
+| 权限点 | `GET /admin/permissions`（按分组返回，供权限配置页使用） |
+| 菜单 | `GET /admin/menus/tree`、`POST /admin/menus`、`PUT\|DELETE /admin/menus/{id}` |
+| 系统配置 | `GET\|PUT /admin/configs` |
+| 操作日志 | `GET /admin/operation-logs/page`（按操作人、模块、动作、结果、时间范围筛选）、`GET /admin/operation-logs/{id}` |
+| 字典 | `GET /admin/dicts/drama-category`、`GET /admin/dicts/content-status` |
+
+### 内容管理
+
+| 模块 | 接口 |
+| --- | --- |
+| 短剧 | `GET /admin/dramas/page`、`GET /admin/dramas/{id}`、`POST /admin/dramas`、`PUT\|DELETE /admin/dramas/{id}` |
+| 审核发布 | `POST /admin/dramas/{id}/submit`、`/approve`、`/reject`、`/publish`、`/offline` |
+| 审核记录 | `GET /admin/dramas/{id}/review-records` |
+| 剧集 | `GET /admin/episodes?dramaId=`、`POST /admin/episodes`、`PUT\|DELETE /admin/episodes/{id}`、`PUT /admin/episodes/sort` |
+| 轮播图 | `GET /admin/banners/page`、`POST /admin/banners`、`PUT\|DELETE /admin/banners/{id}`、`PUT /admin/banners/{id}/status`、`PUT /admin/banners/sort` |
+| 短剧类型 | `GET\|POST /admin/drama-categories`、`PUT\|DELETE /admin/drama-categories/{id}`（权限沿用 `drama:*`） |
+
+### 媒资 `/admin/media`
+
+| 方法 | 路径 | 说明 |
+| --- | --- | --- |
+| POST | `/upload/init` | 建立分片会话，返回 `uploadId`、`chunkSize`、`totalChunks` |
+| POST | `/upload/chunk` | 上传单个分片（multipart：`uploadId`、`index`、`file`） |
+| POST | `/upload/complete` | 合并分片，返回媒资（含可访问的 `url`） |
+| GET | `/{id}` | 查询媒资 |
+
+## 媒资存储（本地）
+
+当前没有对象存储，文件直接落在本机磁盘：
+
+| 项 | 默认值 | 说明 |
+| --- | --- | --- |
+| 存储目录 | `./data/uploads` | 配置项 `reelshort.media.root-dir`，按 `业务类型/年月/uuid.ext` 分目录 |
+| 访问前缀 | `/files/**` | 配置项 `reelshort.media.public-prefix`，映射为静态资源 |
+| 分片大小 | 5MB | `reelshort.media.chunk-size`，单文件上限 2GB |
+| 请求上限 | 20MB | `spring.servlet.multipart`，只需容纳一个分片 |
+
+要点：
+
+- `/files/**` 在 `SecurityConfig` 里是公开路径，因为 `<img>` / `<video>` 无法携带请求头。
+- 上传权限：封面用 `cover:upload`，视频用 `episode:upload`。
+- `data/` 是运行时产物，不需要提交到版本库。
+- 换成 OSS/S3 时只需替换 `MediaStorageService`（分片落盘、合并、生成访问地址三处），
+  `MediaService` 与前端接口都不用动。
+
+## 统一约定
+
+- 响应体 `{ code, message, data }`，成功 `code=0`。
+- 分页请求 `pageIndex`（从 1 开始）、`pageSize`，响应 `{ total, list }`。
+- 鉴权头 `Authorization: Bearer <token>`；未登录 `code=401`，无权限 `code=403`。
+- 错误码见架构文档附录 A；业务错误如 `100000` 账号密码错误、`200003` 状态不允许该操作。
+
+## 权限模型
+
+## 客户端接口 `/app/**`
+
+面向 Flutter 客户端，只暴露已上线内容，不含审核状态、操作日志等管理端字段。
+
+| 方法 | 路径 | 说明 |
+| --- | --- | --- |
+| GET | `/app/home/feed` | 首页聚合：轮播（HOME_TOP）+ 分区（热门 / 新剧 / 各分类） |
+| GET | `/app/discover/feed` | 发现页聚合：轮播（DISCOVER）+ 分类分区 |
+| GET | `/app/categories` | 分类列表 |
+| GET | `/app/dramas/{id}` | 详情，含剧集列表，一次请求即可渲染详情页 |
+| GET | `/app/episodes/{id}/play` | 播放票据 |
+
+约定：
+
+- 只返回 `status = published` 的短剧与剧集，未上线按不存在处理。
+- 图片与视频返回相对路径（`/files/...`），客户端拼上服务地址即可。
+- 播放票据三种结果：`FREE`（返回 `playUrl`）、`COIN_REQUIRED`（返回 `unlockCoin`）、
+  `NO_MEDIA`（已上线但还没传视频）。
+- `/app/**` 目前在安全配置里放行（浏览无需登录）；手机号/邮箱登录与权益体系接入后再收紧。
+
+性能（本机实测，预热后 30 次采样，目标 50ms）：
+
+| 接口 | 平均 | P95 | 最大 | 响应体 |
+| --- | --- | --- | --- | --- |
+| `/app/home/feed` | 13.6ms | 20.3ms | 23.4ms | 3.9KB |
+| `/app/discover/feed` | 7.3ms | 8.1ms | 8.8ms | 1.7KB |
+| `/app/categories` | 2.0ms | 2.1ms | 3.4ms | 0.2KB |
+| `/app/dramas/{id}` | 2.8ms | 3.1ms | 3.5ms | 0.7KB |
+| `/app/episodes/{id}/play` | 2.2ms | 2.6ms | 3.3ms | 0.2KB |
+
+`SlowRequestLogger` 会对超过 50ms 的 `/app/**` 请求打 WARN 日志，
+内容量增长或索引失效时能第一时间发现；首页聚合是查询最多的一档（分类 + 热门 + 新剧 + 各分类列表），
+如果将来分类变多，优先给它加缓存。
+
+## 权限模型
+
+- 权限码随 JWT 下发（如 `drama:create`、`banner:list`），控制器用
+  `@PreAuthorize("@ss.hasPermission('drama:create')")` 校验。
+- 菜单树由权限码派生：角色拥有哪些权限，就可见哪些菜单。
+- 内容状态机：`draft → reviewing → approved → published → offline`。
+  草稿不能直接发布，已上线的短剧需先下线才能删除；每次流转写入审核记录与操作日志。
+- 鉴权实时读库（`PermissionChecker` 通过 `PermissionProvider` 查当前用户的权限），
+  后台改了角色权限或菜单，**前端刷新一下即可生效，不用重新登录**。
+  前端在每次进入应用时会重新拉取 `GET /admin/auth/menus` 与 `GET /admin/auth/profile`。
+
+## 操作日志
+
+后台写操作由切面自动记录，**不需要在每个接口里手写**，在控制器方法上加注解即可：
+
+```java
+@OperationLog(module = "内容管理", action = "新增短剧类型")
+public Result<Long> create(@Valid @RequestBody DramaCategorySaveReqVO req) { ... }
+```
+
+每次调用记录：操作人、操作时间、模块、动作、请求方式与地址、请求参数、请求体、
+响应体、成功/失败、错误信息、耗时、IP。
+
+约定：
+
+- 只记写操作（POST/PUT/DELETE），GET 查询不入库，避免刷屏。
+- 请求体与响应体超过 4000 字符会截断；密码、密钥、token 等字段自动替换成 `***`。
+- 业务异常记 `FAIL` 并带错误信息；`@PreAuthorize` 拦下的越权访问由
+  `AccessDeniedRecorder` 单独记一条（模块=安全，动作=越权访问被拒绝）。
+- 日志写入失败不影响业务（切面内兜底 try/catch）。
+- 查看入口：后台管理 → 操作日志，权限码 `log:list`，默认只给超级管理员。
+
+## 前端对接
+
+管理后台 `../ReelShortWeb` 已完成全部对接，本地演示数据已删除：
+
+| 页面 | 使用接口 |
+| --- | --- |
+| 登录 / 左侧菜单 | `POST /admin/auth/login`、`GET /admin/auth/menus` |
+| 工作台 | `GET /admin/dramas/page`（统计与最近更新） |
+| 短剧管理 | `/admin/dramas/**`、`/admin/dicts/drama-category`、审核发布动作 |
+| 剧集管理 | `/admin/episodes/**`、`PUT /admin/episodes/sort` |
+| 角色权限配置 | `/admin/roles/**`、`GET /admin/permissions`、`GET /admin/role-categories` |
+| 管理员用户列表 | `/admin/admin-users/**` |
+| 菜单管理 | `GET /admin/menus/tree` + 增删改 |
+| 角色分类 | `/admin/role-categories/**` |
+| 系统设置 | `GET\|PUT /admin/configs` |
+
+前端侧改动：
+
+1. `.env.base` 关闭 mock（`VITE_USE_MOCK=false`）；
+2. `vite.config.mts` 增加 `/admin` 代理到 `http://127.0.0.1:8080`；
+3. `src/api/admin/*.ts` 封装全部管理端接口；
+4. 请求头自动携带 `Authorization: Bearer <token>`；
+5. `src/stores/rbac.js` 的 `can(code)` 改用登录返回的权限码，
+   原 `src/data/`、`src/permissions/` 下的演示数据已删除；
+6. 表格状态列改用接口返回的 `status` / `statusText`，
+   大数值用 `src/utils/format.js` 的 `formatCount` 格式化。
+
+## 尚未实现
+
+视频转码（HLS 多码率）、C 端接口（`/app/**`）、金币与会员、单集解锁、支付与对账、
+数据看板统计、Redis 缓存与限流。详见架构设计文档第 11 章。
+
+## 常见问题
+
+**编译报「找不到符号 getXxx / 无法推断类型参数」**
+Lombok 注解处理器没跑起来。确认是在 JDK 21 下构建（`mvn -v` 应显示 Java 21），
+父 POM 已声明 `annotationProcessorPaths`，若仍报错先 `mvn clean`。
+
+**8080 端口被占用**
+
+```sh
+lsof -tiTCP:8080 -sTCP:LISTEN | xargs kill
+```
+
+**brew 连不上 GitHub**
+本机访问 `github.com` 不通，brew 仓库已改用清华镜像：
+
+```sh
+git -C /opt/homebrew remote set-url origin https://mirrors.tuna.tsinghua.edu.cn/git/homebrew/brew.git
+```
+
+Bottle 走 USTC 镜像（环境变量 `HOMEBREW_BOTTLE_DOMAIN`）。
+要换回官方源，把 `origin` 改回 `https://github.com/Homebrew/brew` 即可。
+
+**临时切换 JDK**
+
+```sh
+export JAVA_HOME=$(/usr/libexec/java_home -v 21)
+```
+
+Homebrew 的 Maven 在 `JAVA_HOME` 未设置时会回退到它自带的 JDK（当前为 27），
+父 POM 的注解处理器配置保证这种情况下也能编译通过。
diff --git a/data/uploads/.gitkeep b/data/uploads/.gitkeep
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/data/uploads/.gitkeep
@@ -0,0 +1 @@
+
diff --git a/docs/architecture-design.md b/docs/architecture-design.md
new file mode 100644
index 0000000..e402ca0
--- /dev/null
+++ b/docs/architecture-design.md
@@ -0,0 +1,878 @@
+# ReelShort 短剧服务 · 后端架构设计
+
+> 技术栈：JDK 21（LTS，编译目标 Java 17）+ Spring Boot 3.2 + PostgreSQL 18 + Redis
+>
+> 实现说明：项目已从 MySQL 切换到 PostgreSQL。本文档第 5 章的 DDL 仍按 MySQL 语法书写，
+> 实际建表语句见 `sql/schema.sql`（PostgreSQL 版），两者的字段与索引一一对应；
+> 主要差异是自增列用 IDENTITY、`updated_at` 用触发器维护、索引独立创建。
+> 面向两端：管理后台（ReelShortWeb / Vue3）、客户端（ReelShort / Flutter）
+> 版本：v1（2026-10-14）
+
+---
+
+## 1. 背景与目标
+
+### 1.1 现状
+
+| 端 | 目录 | 技术 | 状态 |
+| --- | --- | --- | --- |
+| 管理后台 | `ReelShort/ReelShortWeb` | Vue3 + Vite + element-plus-admin | 页面完成，数据为前端 mock |
+| 客户端 | `ReelShort/ReelShort` | Flutter | 页面完成，数据为本地演示数据 |
+| 服务端 | `FruitServer` | Spring Boot 3 + MyBatis-Plus + PostgreSQL | 已实现 |
+
+两端的领域模型已经落在代码里，后端要按它们已有的字段和交互来设计，而不是重新发明一套：
+
+- 后台：短剧（`title / genre / status / episodes / views / updatedAt / description / cover`）、剧集（`dramaId / number / title / duration / status / views`）、角色、角色分类、权限点、菜单、管理员、系统设置。
+- 客户端：短剧目录、剧集列表（`isFree` 决定能否播放）、收藏、点赞、评论、观看历史、金币、会员。
+- 后台现在靠 mock 提供登录（`POST /mock/user/login`）与菜单路由树（`GET /mock/role/list`）；统一响应壳是 `{ code: 0, message, data }`，鉴权头是 `Authorization`，`code === 401` 触发登出。后端必须能一比一替换掉这两个 mock。
+
+### 1.2 设计目标
+
+1. 一套服务同时支撑 B 端（管理后台）与 C 端（客户端），共用内容域数据。
+2. 先做模块化单体，边界清晰，规模上来后可按模块拆分，不做超前微服务化。
+3. 内容生产链路（上传 → 转码 → 审核 → 发布）与播放链路（鉴权 → 签名地址 → 防盗链）是两条主线，一次设计到位。
+4. 变现能力（金币 / 会员 / 单集解锁 / 充值订单）从第一天就纳入领域模型，避免后期改表。
+
+---
+
+## 2. 总体架构
+
+```
+┌──────────────────┐        ┌──────────────────┐
+│  Flutter 客户端   │        │  Vue 管理后台     │
+└────────┬─────────┘        └────────┬─────────┘
+         │ /app/**                   │ /admin/**
+         └────────────┬──────────────┘
+                      ▼
+              ┌───────────────┐
+              │  Nginx / SLB  │  路由、TLS、限流、静态资源
+              └───────┬───────┘
+                      ▼
+        ┌─────────────────────────────┐
+        │  Spring Boot 应用（单体多模块）│
+        │  admin-api / app-api / job  │
+        └───┬───────┬────────┬────────┘
+            │       │        │
+      ┌─────▼──┐ ┌──▼───┐ ┌──▼─────────┐
+      │ PgSQL  │ │Redis │ │ 对象存储+CDN │
+      └────────┘ └──────┘ └─────┬──────┘
+                                │
+                       ┌────────▼────────┐
+                       │ 转码 Worker(FFmpeg)│ 消费队列，产出 HLS/MP4
+                       └─────────────────┘
+```
+
+分层原则：
+
+- 接入层：`admin-api` 与 `app-api` 是两个独立入口，各自独立的鉴权过滤器、限流策略、参数校验，互不污染。
+- 领域层：按业务域切模块（system / content / media / member / interaction / trade / stat），模块之间只通过 Service 接口调用，禁止跨模块直连 Mapper。
+- 基础设施层：`framework` 收敛所有技术细节（安全、缓存、MyBatis、日志、OSS SDK），业务模块不直接依赖第三方 SDK。
+
+---
+
+## 3. 技术选型
+
+| 领域 | 选型 | 说明 |
+| --- | --- | --- |
+| 语言/运行时 | JDK 21（LTS） | 编译目标 Java 17；Spring Boot 3 要求 17+ |
+| 框架 | Spring Boot 3.2.x + Spring MVC | 前后端分离，纯 REST |
+| 持久层 | MyBatis-Plus 3.5.x | 后台 CRUD 密集，代码生成 + 分页插件省事 |
+| 数据库 | PostgreSQL 18（UTF8） | 逻辑删除 + 乐观锁字段统一规范；DDL 见 sql/schema.sql |
+| 缓存 | Redis 7 | 登录态、验证码、热点目录、播放签名、分布式锁 |
+| 鉴权 | Spring Security + JWT（jjwt） | B 端与 C 端共用签发逻辑，各自独立过滤器 |
+| 对象存储 | 阿里云 OSS / S3 兼容（本地用 MinIO） | 视频与封面，分片直传 |
+| 转码 | FFmpeg + 异步队列 | 产出 HLS（多码率）+ MP4 兜底 + 首帧封面 |
+| 消息队列 | RabbitMQ（起步） | 转码任务、订单超时、统计埋点；量级大再换 Kafka |
+| 接口文档 | springdoc-openapi | 自动生成 OpenAPI 3 |
+| 定时任务 | Spring Scheduling / XXL-Job | 定时发布、日报聚合、支付对账 |
+| 构建 | Maven 多模块 | 见第 4 节 |
+
+---
+
+## 4. 工程结构（Maven 多模块）
+
+```
+java/
+├── pom.xml                       # 聚合父 POM，统一依赖版本
+├── reelshort-common/             # 统一响应/异常/常量/枚举/工具
+├── reelshort-framework/          # 安全、MyBatis、Redis、日志、限流、OSS、MQ 客户端
+├── reelshort-module-system/      # 管理员、角色、权限、菜单、配置、操作日志
+├── reelshort-module-content/     # 短剧、剧集、分类标签、审核发布
+├── reelshort-module-media/       # 媒资上传、转码、播放地址签名
+├── reelshort-module-member/      # C 端用户、登录、设备、资料
+├── reelshort-module-interaction/ # 收藏、点赞、评论、观看历史
+├── reelshort-module-trade/       # 金币、流水、解锁、订单、VIP
+├── reelshort-module-stat/        # 数据看板、日聚合
+├── reelshort-admin-api/          # B 端接口，/admin/**
+├── reelshort-app-api/            # C 端接口，/app/**
+└── reelshort-job/                # 定时任务与异步消费者
+```
+
+起步阶段若不想铺这么开，可先合并为 `reelshort-common` + `reelshort-server`（含 system/content/media）+ `reelshort-app-api`，但包结构仍按域划分（`com.reelshort.content.*`），后续拆模块零成本。
+
+模块内部结构保持一致：
+
+```
+com.reelshort.content
+├── controller/        # 仅 admin-api / app-api 暴露
+├── service/           # 接口 + impl
+├── dal/
+│   ├── entity/        # 数据库实体
+│   ├── mapper/        # MyBatis-Plus Mapper
+│   └── redis/         # 该域的缓存操作
+├── convert/           # entity <-> VO/DTO 转换（MapStruct）
+└── api/               # 暴露给其它模块的 Service 接口
+```
+
+命名约定：
+
+- 包名 `com.reelshort.<module>.<layer>`
+- 实体 `Drama`、`DramaEpisode`、`AppUser`
+- 请求对象 `XxxCreateReqVO` / `XxxUpdateReqVO` / `XxxPageReqVO`，响应对象 `XxxRespVO`
+- 表名 `<域前缀>_<业务>`，如 `drama`、`drama_episode`、`sys_role`、`app_user`、`stat_drama_daily`
+
+---
+
+## 5. 领域模型与数据库设计
+
+### 5.1 设计约定
+
+- 主键统一 `bigint unsigned`；对外可选用雪花 ID，不暴露自增趋势。
+- 所有表带 `created_at / updated_at`，业务表带 `deleted tinyint default 0`（逻辑删除）。
+- 金额一律用 `int` 分或 `bigint` 微单位，禁用 float；金币用 `bigint`。
+- 状态字段存英文码，中文只用于前端展示，不把界面文案写进数据库。后台现有文案映射：
+
+| 前端展示 | 存储码 |
+| --- | --- |
+| 草稿 | `draft` |
+| 审核中 / 待审核 | `reviewing` |
+| 待发布 | `approved` |
+| 已上线 | `published` |
+| 已下线 | `offline` |
+
+### 5.2 系统域（B 端权限）
+
+```sql
+CREATE TABLE sys_admin_user (
+  id            BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  username      VARCHAR(64)  NOT NULL COMMENT '登录名',
+  password      VARCHAR(100) NOT NULL COMMENT 'BCrypt 哈希',
+  real_name     VARCHAR(64)  NOT NULL DEFAULT '',
+  mobile        VARCHAR(20)  NOT NULL DEFAULT '',
+  email         VARCHAR(128) NOT NULL DEFAULT '',
+  avatar        VARCHAR(255) NOT NULL DEFAULT '',
+  status        TINYINT      NOT NULL DEFAULT 1 COMMENT '1启用 0停用',
+  ip_whitelist  VARCHAR(255) NOT NULL DEFAULT '' COMMENT '空=不限',
+  two_factor    TINYINT      NOT NULL DEFAULT 0 COMMENT '1已开启 0未开启',
+  last_login_at DATETIME(3)  NULL,
+  last_login_ip VARCHAR(64)  NOT NULL DEFAULT '',
+  created_at    DATETIME(3)  NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  updated_at    DATETIME(3)  NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  deleted       TINYINT      NOT NULL DEFAULT 0,
+  UNIQUE KEY uk_username (username)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE sys_role_category (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  name VARCHAR(64) NOT NULL,
+  description VARCHAR(255) NOT NULL DEFAULT '',
+  sort INT NOT NULL DEFAULT 0,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  deleted TINYINT NOT NULL DEFAULT 0,
+  UNIQUE KEY uk_name (name)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE sys_role (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  name VARCHAR(64) NOT NULL,
+  code VARCHAR(64) NOT NULL COMMENT '如 super_admin / content_operator',
+  category_id BIGINT UNSIGNED NOT NULL DEFAULT 0,
+  level INT NOT NULL DEFAULT 9 COMMENT '越小权限越高',
+  description VARCHAR(255) NOT NULL DEFAULT '',
+  status TINYINT NOT NULL DEFAULT 1,
+  is_builtin TINYINT NOT NULL DEFAULT 0 COMMENT '内置角色不可删',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  deleted TINYINT NOT NULL DEFAULT 0,
+  UNIQUE KEY uk_code (code)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE sys_admin_user_role (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  user_id BIGINT UNSIGNED NOT NULL,
+  role_id BIGINT UNSIGNED NOT NULL,
+  UNIQUE KEY uk_user_role (user_id, role_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE sys_permission (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  code VARCHAR(128) NOT NULL COMMENT '如 drama:create',
+  name VARCHAR(64)  NOT NULL COMMENT '如 创建短剧',
+  group_name VARCHAR(64) NOT NULL COMMENT '如 短剧管理',
+  type VARCHAR(16) NOT NULL DEFAULT 'BUTTON' COMMENT 'MENU/BUTTON',
+  sort INT NOT NULL DEFAULT 0,
+  UNIQUE KEY uk_code (code)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE sys_menu (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  parent_id BIGINT UNSIGNED NOT NULL DEFAULT 0,
+  title VARCHAR(64) NOT NULL,
+  route_path VARCHAR(128) NOT NULL DEFAULT '',
+  route_name VARCHAR(64) NOT NULL DEFAULT '',
+  component VARCHAR(255) NOT NULL DEFAULT '' COMMENT '如 views/contentManagement/DramaManagementView',
+  icon VARCHAR(64) NOT NULL DEFAULT '',
+  permission_code VARCHAR(128) NOT NULL DEFAULT '',
+  type VARCHAR(16) NOT NULL DEFAULT 'MENU' COMMENT 'CATALOG/MENU/BUTTON',
+  sort INT NOT NULL DEFAULT 0,
+  visible TINYINT NOT NULL DEFAULT 1,
+  status TINYINT NOT NULL DEFAULT 1,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE sys_role_permission (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  role_id BIGINT UNSIGNED NOT NULL,
+  permission_id BIGINT UNSIGNED NOT NULL,
+  UNIQUE KEY uk_role_perm (role_id, permission_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE sys_role_menu (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  role_id BIGINT UNSIGNED NOT NULL,
+  menu_id BIGINT UNSIGNED NOT NULL,
+  UNIQUE KEY uk_role_menu (role_id, menu_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE sys_config (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  config_key VARCHAR(128) NOT NULL,
+  config_value VARCHAR(1024) NOT NULL DEFAULT '',
+  remark VARCHAR(255) NOT NULL DEFAULT '',
+  UNIQUE KEY uk_key (config_key)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE sys_operation_log (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  admin_user_id BIGINT UNSIGNED NOT NULL,
+  username VARCHAR(64) NOT NULL DEFAULT '',
+  module VARCHAR(64) NOT NULL DEFAULT '',
+  action VARCHAR(64) NOT NULL DEFAULT '',
+  target_type VARCHAR(64) NOT NULL DEFAULT '',
+  target_id BIGINT UNSIGNED NOT NULL DEFAULT 0,
+  detail JSON NULL,
+  ip VARCHAR(64) NOT NULL DEFAULT '',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  KEY idx_admin_time (admin_user_id, created_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+```
+
+### 5.3 内容域
+
+```sql
+CREATE TABLE drama_category (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  name VARCHAR(64) NOT NULL,
+  sort INT NOT NULL DEFAULT 0,
+  status TINYINT NOT NULL DEFAULT 1,
+  UNIQUE KEY uk_name (name)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE drama (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  code VARCHAR(64) NOT NULL DEFAULT '' COMMENT '对外编号',
+  title VARCHAR(128) NOT NULL,
+  subtitle VARCHAR(128) NOT NULL DEFAULT '',
+  category_id BIGINT UNSIGNED NOT NULL DEFAULT 0,
+  genre VARCHAR(64) NOT NULL DEFAULT '' COMMENT '展示用题材',
+  synopsis VARCHAR(1000) NOT NULL DEFAULT '' COMMENT '简介，对应前端 description',
+  cover_url VARCHAR(512) NOT NULL DEFAULT '' COMMENT '竖版封面',
+  horizontal_cover_url VARCHAR(512) NOT NULL DEFAULT '',
+  language VARCHAR(16) NOT NULL DEFAULT 'zh-CN',
+  total_episodes INT NOT NULL DEFAULT 0 COMMENT '冗余，由剧集同步',
+  free_episodes INT NOT NULL DEFAULT 3 COMMENT '前 N 集免费',
+  unlock_coin INT NOT NULL DEFAULT 0 COMMENT '默认单集解锁金币',
+  status VARCHAR(16) NOT NULL DEFAULT 'draft' COMMENT 'draft/reviewing/approved/published/offline',
+  publish_at DATETIME(3) NULL COMMENT '定时上线时间',
+  published_at DATETIME(3) NULL,
+  view_count BIGINT NOT NULL DEFAULT 0 COMMENT '展示口径播放量',
+  play_count BIGINT NOT NULL DEFAULT 0,
+  favorite_count BIGINT NOT NULL DEFAULT 0,
+  like_count BIGINT NOT NULL DEFAULT 0,
+  sort INT NOT NULL DEFAULT 0,
+  create_by BIGINT UNSIGNED NOT NULL DEFAULT 0,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  deleted TINYINT NOT NULL DEFAULT 0,
+  KEY idx_status_publish (status, publish_at),
+  KEY idx_category (category_id),
+  KEY idx_updated (updated_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE drama_episode (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  drama_id BIGINT UNSIGNED NOT NULL,
+  ep_no INT NOT NULL COMMENT '第几集，对应前端 number',
+  title VARCHAR(128) NOT NULL DEFAULT '',
+  duration_sec INT NOT NULL DEFAULT 0 COMMENT '前端展示 mm:ss，存秒',
+  cover_url VARCHAR(512) NOT NULL DEFAULT '',
+  video_asset_id BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT '指向 media_asset',
+  is_free TINYINT NOT NULL DEFAULT 0,
+  unlock_coin INT NOT NULL DEFAULT 0,
+  status VARCHAR(16) NOT NULL DEFAULT 'draft' COMMENT 'draft/approved/published/offline',
+  release_at DATETIME(3) NULL COMMENT '预约/定时发布',
+  play_count BIGINT NOT NULL DEFAULT 0,
+  sort INT NOT NULL DEFAULT 0,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  deleted TINYINT NOT NULL DEFAULT 0,
+  UNIQUE KEY uk_drama_ep (drama_id, ep_no),
+  KEY idx_drama_status (drama_id, status)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE drama_review_record (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  biz_type VARCHAR(16) NOT NULL COMMENT 'DRAMA/EPISODE',
+  biz_id BIGINT UNSIGNED NOT NULL,
+  action VARCHAR(16) NOT NULL COMMENT 'SUBMIT/APPROVE/REJECT/PUBLISH/OFFLINE',
+  reason VARCHAR(500) NOT NULL DEFAULT '',
+  operator_id BIGINT UNSIGNED NOT NULL DEFAULT 0,
+  operator_name VARCHAR(64) NOT NULL DEFAULT '',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  KEY idx_biz (biz_type, biz_id, created_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+```
+
+### 5.4 媒资域
+
+```sql
+CREATE TABLE media_asset (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  biz_type VARCHAR(16) NOT NULL COMMENT 'EPISODE/DRAMA_COVER/AVATAR',
+  file_name VARCHAR(255) NOT NULL DEFAULT '',
+  object_key VARCHAR(512) NOT NULL DEFAULT '' COMMENT 'OSS 原始文件 key',
+  source_url VARCHAR(512) NOT NULL DEFAULT '',
+  size_bytes BIGINT NOT NULL DEFAULT 0,
+  md5 VARCHAR(64) NOT NULL DEFAULT '',
+  duration_sec INT NOT NULL DEFAULT 0,
+  width INT NOT NULL DEFAULT 0,
+  height INT NOT NULL DEFAULT 0,
+  status VARCHAR(16) NOT NULL DEFAULT 'uploading'
+    COMMENT 'uploading/uploaded/transcoding/ready/failed',
+  hls_url VARCHAR(512) NOT NULL DEFAULT '' COMMENT 'm3u8 播放地址',
+  mp4_url VARCHAR(512) NOT NULL DEFAULT '',
+  poster_url VARCHAR(512) NOT NULL DEFAULT '' COMMENT '首帧封面',
+  create_by BIGINT UNSIGNED NOT NULL DEFAULT 0,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  deleted TINYINT NOT NULL DEFAULT 0,
+  KEY idx_status (status)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE transcode_task (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  asset_id BIGINT UNSIGNED NOT NULL,
+  spec VARCHAR(32) NOT NULL DEFAULT '720p' COMMENT '360p/540p/720p/1080p',
+  status VARCHAR(16) NOT NULL DEFAULT 'pending' COMMENT 'pending/running/success/failed',
+  progress INT NOT NULL DEFAULT 0,
+  error_msg VARCHAR(500) NOT NULL DEFAULT '',
+  started_at DATETIME(3) NULL,
+  finished_at DATETIME(3) NULL,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  KEY idx_asset (asset_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+```
+
+### 5.5 会员与互动域（C 端）
+
+```sql
+CREATE TABLE app_user (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  nickname VARCHAR(64) NOT NULL DEFAULT '',
+  avatar VARCHAR(512) NOT NULL DEFAULT '',
+  mobile VARCHAR(20) NOT NULL DEFAULT '',
+  email VARCHAR(128) NOT NULL DEFAULT '',
+  password VARCHAR(100) NOT NULL DEFAULT '' COMMENT '可空，优先验证码登录',
+  gender VARCHAR(16) NOT NULL DEFAULT 'unknown',
+  birthday DATE NULL,
+  register_channel VARCHAR(32) NOT NULL DEFAULT 'app',
+  status TINYINT NOT NULL DEFAULT 1 COMMENT '1正常 0封禁',
+  vip_expire_at DATETIME(3) NULL COMMENT '冗余，便于查询',
+  last_login_at DATETIME(3) NULL,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  deleted TINYINT NOT NULL DEFAULT 0,
+  UNIQUE KEY uk_mobile (mobile)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE user_watch_history (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  user_id BIGINT UNSIGNED NOT NULL,
+  drama_id BIGINT UNSIGNED NOT NULL,
+  episode_id BIGINT UNSIGNED NOT NULL,
+  position_sec INT NOT NULL DEFAULT 0,
+  duration_sec INT NOT NULL DEFAULT 0,
+  finished TINYINT NOT NULL DEFAULT 0,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  UNIQUE KEY uk_user_episode (user_id, episode_id),
+  KEY idx_user_time (user_id, updated_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE user_favorite (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  user_id BIGINT UNSIGNED NOT NULL,
+  drama_id BIGINT UNSIGNED NOT NULL,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  UNIQUE KEY uk_user_drama (user_id, drama_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE user_like (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  user_id BIGINT UNSIGNED NOT NULL,
+  drama_id BIGINT UNSIGNED NOT NULL,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  UNIQUE KEY uk_user_drama (user_id, drama_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE drama_comment (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  drama_id BIGINT UNSIGNED NOT NULL,
+  episode_id BIGINT UNSIGNED NOT NULL DEFAULT 0,
+  user_id BIGINT UNSIGNED NOT NULL,
+  parent_id BIGINT UNSIGNED NOT NULL DEFAULT 0,
+  content VARCHAR(500) NOT NULL,
+  like_count INT NOT NULL DEFAULT 0,
+  status TINYINT NOT NULL DEFAULT 1 COMMENT '1正常 0隐藏',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  deleted TINYINT NOT NULL DEFAULT 0,
+  KEY idx_drama_time (drama_id, created_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+```
+
+### 5.6 交易域（金币 / 会员 / 解锁）
+
+```sql
+CREATE TABLE user_coin_account (
+  user_id BIGINT UNSIGNED PRIMARY KEY,
+  balance BIGINT NOT NULL DEFAULT 0,
+  total_recharge BIGINT NOT NULL DEFAULT 0,
+  total_consume BIGINT NOT NULL DEFAULT 0,
+  version INT NOT NULL DEFAULT 0 COMMENT '乐观锁',
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE coin_transaction (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  user_id BIGINT UNSIGNED NOT NULL,
+  type VARCHAR(16) NOT NULL COMMENT 'RECHARGE/UNLOCK/REFUND/GIFT/ADJUST',
+  amount BIGINT NOT NULL COMMENT '正数入账，负数出账',
+  balance_after BIGINT NOT NULL,
+  biz_type VARCHAR(32) NOT NULL DEFAULT '',
+  biz_id BIGINT UNSIGNED NOT NULL DEFAULT 0,
+  idempotent_key VARCHAR(128) NOT NULL DEFAULT '',
+  remark VARCHAR(255) NOT NULL DEFAULT '',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  UNIQUE KEY uk_idempotent (idempotent_key),
+  KEY idx_user_time (user_id, created_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE episode_unlock (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  user_id BIGINT UNSIGNED NOT NULL,
+  drama_id BIGINT UNSIGNED NOT NULL,
+  episode_id BIGINT UNSIGNED NOT NULL,
+  unlock_type VARCHAR(16) NOT NULL COMMENT 'COIN/VIP',
+  coin_cost BIGINT NOT NULL DEFAULT 0,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  UNIQUE KEY uk_user_episode (user_id, episode_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE vip_plan (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  name VARCHAR(64) NOT NULL,
+  days INT NOT NULL,
+  price_cent INT NOT NULL,
+  original_price_cent INT NOT NULL DEFAULT 0,
+  status TINYINT NOT NULL DEFAULT 1,
+  sort INT NOT NULL DEFAULT 0
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE app_order (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  order_no VARCHAR(64) NOT NULL,
+  user_id BIGINT UNSIGNED NOT NULL,
+  biz_type VARCHAR(16) NOT NULL COMMENT 'RECHARGE/VIP',
+  product_id BIGINT UNSIGNED NOT NULL DEFAULT 0,
+  subject VARCHAR(128) NOT NULL DEFAULT '',
+  amount_cent INT NOT NULL,
+  coin_amount BIGINT NOT NULL DEFAULT 0,
+  channel VARCHAR(32) NOT NULL DEFAULT '' COMMENT 'alipay/wechat/apple/stripe',
+  channel_trade_no VARCHAR(128) NOT NULL DEFAULT '',
+  status VARCHAR(16) NOT NULL DEFAULT 'CREATED' COMMENT 'CREATED/PAID/CLOSED/REFUNDED',
+  paid_at DATETIME(3) NULL,
+  expire_at DATETIME(3) NULL COMMENT '超时关单时间',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  UNIQUE KEY uk_order_no (order_no),
+  UNIQUE KEY uk_channel_trade (channel, channel_trade_no),
+  KEY idx_user_status (user_id, status)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE vip_membership (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  user_id BIGINT UNSIGNED NOT NULL,
+  plan_id BIGINT UNSIGNED NOT NULL,
+  order_id BIGINT UNSIGNED NOT NULL,
+  start_at DATETIME(3) NOT NULL,
+  expire_at DATETIME(3) NOT NULL,
+  status VARCHAR(16) NOT NULL DEFAULT 'ACTIVE',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  KEY idx_user (user_id, expire_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+```
+
+### 5.7 统计域
+
+```sql
+CREATE TABLE stat_drama_daily (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  stat_date DATE NOT NULL,
+  drama_id BIGINT UNSIGNED NOT NULL,
+  play_count BIGINT NOT NULL DEFAULT 0,
+  uv BIGINT NOT NULL DEFAULT 0,
+  new_favorite BIGINT NOT NULL DEFAULT 0,
+  unlock_count BIGINT NOT NULL DEFAULT 0,
+  coin_income BIGINT NOT NULL DEFAULT 0,
+  vip_income_cent BIGINT NOT NULL DEFAULT 0,
+  UNIQUE KEY uk_date_drama (stat_date, drama_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE stat_episode_daily (
+  id BIGINT UNSIGNED PRIMARY KEY AUTO_INCREMENT,
+  stat_date DATE NOT NULL,
+  episode_id BIGINT UNSIGNED NOT NULL,
+  drama_id BIGINT UNSIGNED NOT NULL,
+  play_count BIGINT NOT NULL DEFAULT 0,
+  uv BIGINT NOT NULL DEFAULT 0,
+  avg_watch_sec INT NOT NULL DEFAULT 0,
+  UNIQUE KEY uk_date_episode (stat_date, episode_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+```
+
+---
+
+## 6. 接口设计
+
+### 6.1 统一约定
+
+- 基础路径：B 端 `/admin/**`，C 端 `/app/**`。
+- 响应壳（与后台 axios 拦截器一致）：`{ "code": 0, "message": "ok", "data": ... }`；失败 `code != 0`；未登录 `code = 401`。
+- 分页：请求 `pageIndex`（从 1 开始）、`pageSize`；响应 `{ "total": n, "list": [...] }`。
+- 鉴权：请求头 `Authorization: Bearer <token>`；B 端与 C 端 token 独立签发、独立校验。
+- 时间：`yyyy-MM-dd HH:mm:ss` 或毫秒时间戳，全项目统一一种。
+
+### 6.2 B 端接口
+
+必须与现有 mock 结构兼容的两个接口：
+
+| 方法 | 路径 | 说明 | 兼容要求 |
+| --- | --- | --- | --- |
+| POST | `/admin/auth/login` | 管理员登录 | 返回 `data` 至少含 `username / role / roleId / token`，字段名与 `mock/user/index.mock.ts` 一致；`permissions` 换为真实权限码数组 |
+| GET | `/admin/auth/menus` | 当前用户菜单路由树 | 结构与 `mock/role/index.mock.ts` 的 `adminList` 完全一致（`path / component / name / meta.title / meta.icon`），`component` 仍是前端组件字符串 |
+
+其余 B 端接口：
+
+| 模块 | 接口 |
+| --- | --- |
+| 认证 | `POST /admin/auth/login`、`POST /admin/auth/logout`、`GET /admin/auth/profile`、`POST /admin/auth/password` |
+| 管理员 | `GET /admin/admin-users/page`、`POST /admin/admin-users`、`PUT /admin/admin-users/{id}`、`DELETE /admin/admin-users/{id}`、`PUT /admin/admin-users/{id}/status`、`PUT /admin/admin-users/{id}/password` |
+| 角色 | `GET /admin/roles/page`、`POST /admin/roles`、`PUT /admin/roles/{id}`、`DELETE /admin/roles/{id}`、`GET /admin/roles/{id}/permissions`、`PUT /admin/roles/{id}/permissions` |
+| 角色分类 | `GET /admin/role-categories`、`POST /admin/role-categories`、`PUT /admin/role-categories/{id}`、`DELETE /admin/role-categories/{id}` |
+| 权限点 | `GET /admin/permissions`（按 group 分组，直接喂权限配置页） |
+| 菜单 | `GET /admin/menus/tree`、`POST /admin/menus`、`PUT /admin/menus/{id}`、`DELETE /admin/menus/{id}` |
+| 短剧 | `GET /admin/dramas/page`、`GET /admin/dramas/{id}`、`POST /admin/dramas`、`PUT /admin/dramas/{id}`、`DELETE /admin/dramas/{id}`、`PUT /admin/dramas/{id}/status` |
+| 剧集 | `GET /admin/dramas/{dramaId}/episodes`、`POST /admin/episodes`、`PUT /admin/episodes/{id}`、`DELETE /admin/episodes/{id}`、`PUT /admin/episodes/sort` |
+| 审核 | `POST /admin/dramas/{id}/submit`、`/approve`、`/reject`、`/publish`、`/offline` |
+| 媒资 | `POST /admin/media/upload-token`（分片直传凭证）、`POST /admin/media/upload`（小文件）、`GET /admin/media/{id}`（转码进度） |
+| 字典 | `GET /admin/dicts/{type}`（题材、状态等） |
+| 设置 | `GET /admin/configs`、`PUT /admin/configs` |
+| 统计 | `GET /admin/stat/overview`、`GET /admin/stat/dramas`、`GET /admin/stat/trend` |
+
+短剧列表响应示例（字段名对齐前端 `src/data/dramas.js`，前端只需换数据源）：
+
+```json
+{
+  "id": 1,
+  "title": "替嫁新娘：总裁的掌心宠",
+  "genre": "都市情感",
+  "status": "published",
+  "statusText": "已上线",
+  "episodes": 68,
+  "views": 2400000,
+  "cover": "https://cdn.example.com/drama/1/cover.jpg",
+  "description": "一场意外替嫁，让她成为冷面总裁的契约新娘。",
+  "updatedAt": "2025-06-12 10:00:00"
+}
+```
+
+### 6.3 C 端接口
+
+| 模块 | 接口 | 说明 |
+| --- | --- | --- |
+| 认证 | `POST /app/auth/sms-code` | 发送验证码（Redis 限流防刷） |
+| | `POST /app/auth/login` | 手机号+验证码 / 邮箱+密码，返回 `accessToken`、`refreshToken`、用户资料 |
+| | `POST /app/auth/refresh` | 刷新 token |
+| | `POST /app/auth/logout` | 注销当前设备 |
+| 用户 | `GET /app/user/profile`、`PUT /app/user/profile`、`POST /app/user/avatar` | 对应客户端「我的」页 |
+| 目录 | `GET /app/home/feed` | 首页分区流（推荐、热播、新上线） |
+| | `GET /app/discover/sections` | 发现页分区/轮播 |
+| | `GET /app/categories` | 题材分类 |
+| | `GET /app/dramas/{id}` | 详情：简介、总集数、免费集数、收藏/点赞数、当前用户是否收藏/点赞 |
+| | `GET /app/dramas/{id}/episodes` | 剧集列表（含 `isFree`、`locked`、`unlockCoin`） |
+| 播放 | `POST /app/episodes/{id}/play` | 播放鉴权，返回签名播放地址与续播位置 |
+| | `POST /app/history` | 上报观看进度（播放中每 10~15s 节流上报一次） |
+| | `GET /app/history` | 观看历史列表 |
+| 互动 | `GET/POST /app/dramas/{id}/favorites`、`GET/POST /app/dramas/{id}/likes`、`GET/POST /app/dramas/{id}/comments`、`POST /app/comments/{id}/like`、`DELETE /app/comments/{id}` | 对应 `savedDramaIds / likedDramaIds / commentsByDrama` |
+| 钱包 | `GET /app/wallet` | 金币余额、会员状态、到期时间 |
+| | `GET /app/wallet/plans` | 充值档位与 VIP 套餐 |
+| | `POST /app/orders` | 创建充值/会员订单 |
+| | `POST /app/pay/callback/{channel}` | 支付回调（公开接口，验签 + 幂等） |
+| 解锁 | `POST /app/episodes/{id}/unlock` | 金币解锁单集；VIP 用户直接放行 |
+| 其他 | `GET /app/configs` | 客户端启动配置（公告、分享文案、开关） |
+
+播放接口响应示例：
+
+```json
+{
+  "episodeId": 101,
+  "dramaId": 1,
+  "epNo": 4,
+  "duration": 138,
+  "accessible": true,
+  "accessType": "FREE",
+  "playUrl": "https://cdn.example.com/hls/1/101/index.m3u8?auth_key=...&expires=1730000000",
+  "posterUrl": "https://cdn.example.com/hls/1/101/poster.jpg",
+  "resumePosition": 42
+}
+```
+
+`accessible = false` 时返回 `accessType = COIN_REQUIRED | VIP_REQUIRED` 与 `unlockCoin`，客户端据此弹出解锁或开通会员面板。
+
+---
+
+## 7. 关键流程
+
+### 7.1 内容生产（后台）
+
+```
+创建短剧草稿 → 上传封面 → 批量上传剧集视频（分片直传 OSS）
+  → 发布转码任务（MQ 异步） → FFmpeg 产出 HLS/封面 → 回调更新 media_asset
+  → 填写剧集信息（集号、时长、免费标记、解锁金币）
+  → 提交审核（draft → reviewing） → 审核通过（reviewing → approved）
+  → 定时或手动发布（approved → published，publish_at 到点由 job 自动上线）
+  → 客户端目录可见
+```
+
+- 转码异步化，后台轮询 `GET /admin/media/{id}` 拿进度即可，不用长连接。
+- 审核、发布、下线三个动作全部写 `drama_review_record` 与 `sys_operation_log`，可追溯。
+
+### 7.2 播放链路（客户端）
+
+```
+客户端请求 POST /app/episodes/{id}/play
+  → 校验登录态与用户状态
+  → 判定可见性：剧 / 集是否 published
+  → 判定播放权：is_free 命中，或 episode_unlock 命中，或 VIP 有效
+  → 有权：生成带签名的 CDN 地址（有效期 10~30 分钟）→ 返回 playUrl + 续播位置
+  → 无权：返回 COIN_REQUIRED / VIP_REQUIRED，客户端弹窗引导
+```
+
+防盗链三条措施：签名地址短时效、CDN Referer/UA 白名单、HLS 分片加密（AES-128，密钥接口同样鉴权）。
+
+### 7.3 解锁扣费（幂等）
+
+```
+POST /app/episodes/{id}/unlock
+  → 幂等键 user_id + episode_id：先查 episode_unlock，命中直接返回成功
+  → Redis 分布式锁 lock:unlock:{userId}:{episodeId}，挡住连点重复扣费
+  → 一个事务内：扣 user_coin_account（乐观锁 version 校验）
+                → 写 coin_transaction → 写 episode_unlock
+  → 返回最新余额
+```
+
+余额不足返回明确业务码，客户端直接跳充值页。
+
+### 7.4 支付回调
+
+```
+POST /app/pay/callback/{channel}
+  → 验签 → 幂等（channel + channel_trade_no 唯一索引）
+  → 一个事务内：订单置为 PAID → 金币入账（写流水）或开通/续期 VIP
+                → 更新 app_user.vip_expire_at
+  → 返回渠道要求的成功应答
+```
+
+配套对账任务：定时拉取渠道账单与本地订单比对，处理「渠道成功、本地漏回调」。
+
+---
+
+## 8. 非功能设计
+
+### 8.1 鉴权与权限
+
+- B 端：JWT 载荷含 `userId / username / roleId`，过滤器解析后写入 `SecurityContext`；权限校验用注解 `@PreAuthorize("@ss.hasPermission('drama:create')")`，权限码风格与前端 `src/permissions/permissions.js` 对齐。
+- C 端：`accessToken` 短时效（2h）+ `refreshToken` 长时效（30d），存 Redis 支持主动踢下线；键设计 `user:token:{userId}:{deviceId}`。
+- 后台高危操作（删除、发布、改权限）二次校验密码并写 `sys_operation_log`；`two_factor` 字段已在表结构预留。
+
+### 8.2 缓存策略
+
+| 数据 | Key | 策略 |
+| --- | --- | --- |
+| 首页/发现页分区 | `cache:home:feed` | 5 分钟过期，发布/上线/下线时主动失效 |
+| 短剧详情 | `cache:drama:{id}` | 10 分钟 + 主动失效 |
+| 分类字典 | `cache:dict:category` | 1 小时 |
+| 后台权限码 | `cache:perm:role:{roleId}` | 30 分钟，改角色权限时失效 |
+| 验证码 | `sms:code:{mobile}` | 5 分钟，发送限流 1 次/分、5 次/天 |
+| 播放签名 | —— | 不缓存，实时生成 |
+
+热点 Key 加随机后缀防雪崩；空结果缓存短空值防穿透。
+
+### 8.3 限流与防刷
+
+- 接口级限流（Redis 令牌桶）：登录、验证码、评论、解锁扣费。
+- 播放量与观看时长上报去重（`user_id + episode_id + 时间窗`），防止刷量污染统计。
+- 评论接入敏感词过滤，可扩展到第三方内容安全审核。
+- 客户端接口做版本兼容（`X-App-Version`），避免旧版本升级后崩溃。
+
+### 8.4 数据量与扩展
+
+- 增长最快的表：`user_watch_history`、`drama_comment`、`coin_transaction`、`stat_*_daily`。
+- 单表超 2000 万行或写入明显变慢时，按 `user_id` 取模分表（ShardingSphere），对业务代码透明。
+- `stat_*_daily` 属聚合表，量级可控，用分区表即可。
+- 图片与视频全部走 CDN，应用服务器不落盘媒体文件。
+
+### 8.5 可观测与运维
+
+- 日志：JSON 结构化，traceId 贯穿全链路；后台敏感操作另写 `sys_operation_log`。
+- 监控：接口 P99、错误率、转码队列积压、支付回调失败率、Redis 命中率。
+- 健康检查 `/actuator/health` 暴露给负载均衡。
+- 环境：dev / test / prod 三套配置，密钥通过环境变量注入，不写进仓库。
+
+---
+
+## 9. 部署与演进
+
+起步形态（单体）：
+
+```
+Nginx
+ ├── reelshort-admin-api  (/admin)
+ ├── reelshort-app-api    (/app)
+ └── reelshort-job        (定时任务、异步消费)
+PostgreSQL(主从) / Redis / OSS(或 MinIO) / 转码 Worker(独立容器，可多实例水平扩容)
+```
+
+Docker Compose 足够跑通全链路，上线后按量升级到 K8s。
+
+演进路径：单体多模块 → 转码与统计独立进程 → 读写分离 → 内容域/交易域拆为独立服务 → 网关统一入口。拆分只在某模块成为独立瓶颈或有独立迭代节奏时进行，不为拆而拆。
+
+---
+
+## 10. 与现有前端的对接改造点
+
+### 10.1 管理后台（ReelShortWeb）
+
+1. `.env.*`：`VITE_USE_MOCK=false`，`VITE_API_BASE_PATH` 指向后端地址。
+2. 登录：`src/api/login/index.ts` 的 `/mock/user/login` → `/admin/auth/login`，返回体保持 `{ username, role, roleId, token, permissions }`，前端改动最小。
+3. 菜单：`/mock/role/list` → `/admin/auth/menus`，返回同样的路由树结构，`src/router/index.ts` 无需改动。
+4. 业务数据源替换：
+   - `src/data/dramas.js` → `GET /admin/dramas/page`
+   - `src/data/episodes.js` → `GET /admin/dramas/{dramaId}/episodes`
+   - `src/data/roles.js` → `GET /admin/roles/page`
+   - `src/views/userManagement/data/adminUsers.js` → `GET /admin/admin-users/page`
+   - `src/data/customMenus.js`（localStorage）→ `GET/POST /admin/menus`
+   - `src/stores/rbac.js` 的本地权限表 → 登录返回的 `permissions` + `GET /admin/permissions`
+5. 展示文案（已上线/审核中/草稿）改由 `status` 码映射，`src/utils/status.js` 可逐步改用后端返回的 `statusText`。
+
+### 10.2 客户端（ReelShort / Flutter）
+
+1. `DemoCatalogRepository` → HTTP 实现，对接 `/app/home/feed`、`/app/dramas/{id}`、`/app/dramas/{id}/episodes`。
+2. `SharedPreferencesEngagementRepository`（收藏/点赞/评论本地存储）→ HTTP 实现，`EngagementSnapshot` 变为服务端快照。
+3. 观看历史本地存储 → `/app/history`；登录后做一次本地数据合并上传。
+4. `Episode.isFree` 与 `PlaybackSession.canPlay` → 由 `/play` 返回的 `accessible / accessType` 驱动。
+5. 「我的」页金币与会员（当前是 `$ 0` 假数据）→ `/app/wallet`。
+6. 新增登录页，token 用 `flutter_secure_storage` 保存，`refreshToken` 自动续期。
+
+---
+
+## 11. 迭代建议
+
+**M1 · 打通后台**
+系统域（登录、RBAC、菜单、管理员）+ 内容域（短剧/剧集 CRUD）+ 媒资上传（先整文件上传，转码后置）+ 统一响应与鉴权框架。目标：后台 mock 全部替换为真实接口。
+
+**M2 · 打通客户端**
+C 端登录、目录/详情/剧集、观看历史、收藏点赞评论、播放鉴权与签名地址。目标：客户端真实播放，前端演示仓库全部退役。
+
+**M3 · 变现与质量**
+转码流水线（HLS 多码率）、金币与会员、单集解锁、支付与对账、后台数据看板、限流防刷、监控告警。
+
+**M4 · 规模化**
+读写分离、热点缓存优化、大表分表、内容安全、多语言内容（`drama.language` 已预留）。
+
+---
+
+## 附录 A · 错误码规划
+
+| 码 | 含义 |
+| --- | --- |
+| 0 | 成功 |
+| 400 | 参数校验失败 |
+| 401 | 未登录 / token 失效 |
+| 403 | 无权限 |
+| 404 | 资源不存在 |
+| 429 | 请求过于频繁 |
+| 500 | 系统异常 |
+| 100001 | 金币余额不足 |
+| 100002 | 剧集未发布或不存在 |
+| 100003 | 剧集已解锁（幂等返回成功） |
+| 100004 | 订单已支付或已关闭 |
+| 100005 | VIP 已过期 |
+
+## 附录 B · 配置骨架（application.yml）
+
+```yaml
+server:
+  port: 8080
+
+spring:
+  datasource:
+    url: jdbc:postgresql://127.0.0.1:5432/reelshort
+    username: ${DB_USER:reelshort}
+    password: ${DB_PASSWORD:reelshort}
+  data:
+    redis:
+      host: 127.0.0.1
+      port: 6379
+  servlet:
+    multipart:
+      max-file-size: 2GB
+      max-request-size: 2GB
+
+reelshort:
+  jwt:
+    admin-secret: ${JWT_ADMIN_SECRET}
+    app-secret: ${JWT_APP_SECRET}
+    app-access-ttl: 2h
+    app-refresh-ttl: 30d
+  oss:
+    endpoint: ${OSS_ENDPOINT}
+    bucket: ${OSS_BUCKET}
+    access-key: ${OSS_KEY}
+    secret-key: ${OSS_SECRET}
+  cdn:
+    play-domain: https://cdn.example.com
+    sign-ttl-seconds: 1800
+```
diff --git a/pom.xml b/pom.xml
new file mode 100644
index 0000000..f387275
--- /dev/null
+++ b/pom.xml
@@ -0,0 +1,143 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>3.2.5</version>
+        <relativePath/>
+    </parent>
+
+    <groupId>com.reelshort</groupId>
+    <artifactId>reelshort</artifactId>
+    <version>1.0.0-SNAPSHOT</version>
+    <packaging>pom</packaging>
+    <name>reelshort</name>
+    <description>ReelShort 短剧服务</description>
+
+    <modules>
+        <module>reelshort-common</module>
+        <module>reelshort-framework</module>
+        <module>reelshort-module-system</module>
+        <module>reelshort-module-content</module>
+        <module>reelshort-module-media</module>
+        <module>reelshort-admin-api</module>
+        <module>reelshort-app-api</module>
+    </modules>
+
+    <properties>
+        <java.version>17</java.version>
+        <maven.compiler.release>17</maven.compiler.release>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <mybatis-plus.version>3.5.7</mybatis-plus.version>
+        <jjwt.version>0.12.5</jjwt.version>
+        <springdoc.version>2.5.0</springdoc.version>
+        <!-- Spring Boot 3.2 默认的 1.18.32 在 JDK 23+ 上会编译失败，这里提升到支持新 JDK 的版本 -->
+        <lombok.version>1.18.48</lombok.version>
+    </properties>
+
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>com.reelshort</groupId>
+                <artifactId>reelshort-common</artifactId>
+                <version>${project.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>com.reelshort</groupId>
+                <artifactId>reelshort-framework</artifactId>
+                <version>${project.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>com.reelshort</groupId>
+                <artifactId>reelshort-module-system</artifactId>
+                <version>${project.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>com.reelshort</groupId>
+                <artifactId>reelshort-module-content</artifactId>
+                <version>${project.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>com.reelshort</groupId>
+                <artifactId>reelshort-module-media</artifactId>
+                <version>${project.version}</version>
+            </dependency>
+
+            <dependency>
+                <groupId>com.baomidou</groupId>
+                <artifactId>mybatis-plus-spring-boot3-starter</artifactId>
+                <version>${mybatis-plus.version}</version>
+            </dependency>
+
+            <dependency>
+                <groupId>io.jsonwebtoken</groupId>
+                <artifactId>jjwt-api</artifactId>
+                <version>${jjwt.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>io.jsonwebtoken</groupId>
+                <artifactId>jjwt-impl</artifactId>
+                <version>${jjwt.version}</version>
+                <scope>runtime</scope>
+            </dependency>
+            <dependency>
+                <groupId>io.jsonwebtoken</groupId>
+                <artifactId>jjwt-jackson</artifactId>
+                <version>${jjwt.version}</version>
+                <scope>runtime</scope>
+            </dependency>
+
+            <dependency>
+                <groupId>org.springdoc</groupId>
+                <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
+                <version>${springdoc.version}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.projectlombok</groupId>
+            <artifactId>lombok</artifactId>
+            <optional>true</optional>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <pluginManagement>
+            <plugins>
+                <!-- 显式声明注解处理器：JDK 23 起不再默认扫描 classpath 上的处理器，否则 Lombok 会失效 -->
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-compiler-plugin</artifactId>
+                    <configuration>
+                        <proc>full</proc>
+                        <annotationProcessorPaths>
+                            <path>
+                                <groupId>org.projectlombok</groupId>
+                                <artifactId>lombok</artifactId>
+                                <version>${lombok.version}</version>
+                            </path>
+                        </annotationProcessorPaths>
+                    </configuration>
+                </plugin>
+                <plugin>
+                    <groupId>org.springframework.boot</groupId>
+                    <artifactId>spring-boot-maven-plugin</artifactId>
+                    <configuration>
+                        <excludes>
+                            <exclude>
+                                <groupId>org.projectlombok</groupId>
+                                <artifactId>lombok</artifactId>
+                            </exclude>
+                        </excludes>
+                    </configuration>
+                </plugin>
+            </plugins>
+        </pluginManagement>
+    </build>
+</project>
diff --git a/reelshort-admin-api/pom.xml b/reelshort-admin-api/pom.xml
new file mode 100644
index 0000000..36e0663
--- /dev/null
+++ b/reelshort-admin-api/pom.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>com.reelshort</groupId>
+        <artifactId>reelshort</artifactId>
+        <version>1.0.0-SNAPSHOT</version>
+    </parent>
+
+    <artifactId>reelshort-admin-api</artifactId>
+    <name>reelshort-admin-api</name>
+    <description>管理后台接入层：/admin/**</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>com.reelshort</groupId>
+            <artifactId>reelshort-module-system</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.reelshort</groupId>
+            <artifactId>reelshort-module-content</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.reelshort</groupId>
+            <artifactId>reelshort-module-media</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-maven-plugin</artifactId>
+            </plugin>
+        </plugins>
+    </build>
+</project>
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/ReelShortApplication.java b/reelshort-admin-api/src/main/java/com/reelshort/ReelShortApplication.java
new file mode 100644
index 0000000..e2930f1
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/ReelShortApplication.java
@@ -0,0 +1,14 @@
+package com.reelshort;
+
+import org.mybatis.spring.annotation.MapperScan;
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+@MapperScan("com.reelshort.**.dal.mapper")
+public class ReelShortApplication {
+
+    public static void main(String[] args) {
+        SpringApplication.run(ReelShortApplication.class, args);
+    }
+}
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/AdminUserController.java b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/AdminUserController.java
new file mode 100644
index 0000000..08bbab2
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/AdminUserController.java
@@ -0,0 +1,83 @@
+package com.reelshort.admin.controller;
+
+import com.reelshort.common.pojo.PageResult;
+import com.reelshort.common.pojo.Result;
+import com.reelshort.framework.security.SecurityUtils;
+import com.reelshort.system.service.AdminUserService;
+import com.reelshort.framework.log.OperationLog;
+import com.reelshort.system.vo.AdminUserPageReqVO;
+import com.reelshort.system.vo.AdminUserRespVO;
+import com.reelshort.system.vo.AdminUserSaveReqVO;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Map;
+
+@RestController
+@RequestMapping("/admin/admin-users")
+@RequiredArgsConstructor
+public class AdminUserController {
+
+    private final AdminUserService adminUserService;
+
+    @GetMapping("/page")
+    @PreAuthorize("@ss.hasPermission('system:admin-user')")
+    public Result<PageResult<AdminUserRespVO>> page(AdminUserPageReqVO req) {
+        return Result.ok(adminUserService.page(req));
+    }
+
+    @GetMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('system:admin-user')")
+    public Result<AdminUserRespVO> get(@PathVariable Long id) {
+        return Result.ok(adminUserService.get(id));
+    }
+
+    @PostMapping
+    @PreAuthorize("@ss.hasPermission('system:admin-user')")
+    @OperationLog(module = "后台管理", action = "新增管理员")
+    public Result<Long> create(@Valid @RequestBody AdminUserSaveReqVO req) {
+        return Result.ok(adminUserService.create(req));
+    }
+
+    @PutMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('system:admin-user')")
+    @OperationLog(module = "后台管理", action = "编辑管理员")
+    public Result<Void> update(@PathVariable Long id, @Valid @RequestBody AdminUserSaveReqVO req) {
+        adminUserService.update(id, req);
+        return Result.ok();
+    }
+
+    @DeleteMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('system:admin-user')")
+    @OperationLog(module = "后台管理", action = "删除管理员")
+    public Result<Void> delete(@PathVariable Long id) {
+        adminUserService.delete(id);
+        return Result.ok();
+    }
+
+    @PutMapping("/{id}/status")
+    @PreAuthorize("@ss.hasPermission('system:admin-user')")
+    @OperationLog(module = "后台管理", action = "修改管理员状态")
+    public Result<Void> updateStatus(@PathVariable Long id, @RequestParam Integer status) {
+        adminUserService.updateStatus(id, status);
+        return Result.ok();
+    }
+
+    @PutMapping("/{id}/password")
+    @PreAuthorize("@ss.hasPermission('system:admin-user')")
+    @OperationLog(module = "后台管理", action = "重置管理员密码")
+    public Result<Void> resetPassword(@PathVariable Long id, @RequestBody Map<String, String> body) {
+        adminUserService.resetPassword(id, body.get("password"));
+        return Result.ok();
+    }
+}
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/AuthController.java b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/AuthController.java
new file mode 100644
index 0000000..3e2862a
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/AuthController.java
@@ -0,0 +1,61 @@
+package com.reelshort.admin.controller;
+
+import com.reelshort.common.pojo.Result;
+import com.reelshort.framework.security.SecurityUtils;
+import com.reelshort.framework.log.OperationLog;
+import com.reelshort.framework.web.WebUtils;
+import com.reelshort.system.service.AuthService;
+import com.reelshort.system.vo.LoginReqVO;
+import com.reelshort.system.vo.LoginRespVO;
+import com.reelshort.system.vo.MenuVO;
+import com.reelshort.system.vo.PasswordChangeReqVO;
+import com.reelshort.system.vo.ProfileRespVO;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+
+@RestController
+@RequestMapping("/admin/auth")
+@RequiredArgsConstructor
+public class AuthController {
+
+    private final AuthService authService;
+
+    @PostMapping("/login")
+    @OperationLog(module = "认证", action = "登录")
+    public Result<LoginRespVO> login(@Valid @RequestBody LoginReqVO req, HttpServletRequest request) {
+        return Result.ok(authService.login(req, WebUtils.getClientIp(request)));
+    }
+
+    /** 当前用户的菜单路由树，结构与前端 element-plus-admin 的动态路由一致。 */
+    @GetMapping("/menus")
+    public Result<List<MenuVO>> menus() {
+        return Result.ok(authService.listMenus(SecurityUtils.getUserId()));
+    }
+
+    @GetMapping("/profile")
+    public Result<ProfileRespVO> profile() {
+        return Result.ok(authService.profile(SecurityUtils.getUserId()));
+    }
+
+    /** JWT 无状态，登出由前端清除 token 即可。 */
+    @PostMapping("/logout")
+    @OperationLog(module = "认证", action = "退出登录")
+    public Result<Void> logout() {
+        return Result.ok();
+    }
+
+    @PostMapping("/password")
+    @OperationLog(module = "认证", action = "修改密码")
+    public Result<Void> changePassword(@Valid @RequestBody PasswordChangeReqVO req) {
+        authService.changePassword(SecurityUtils.getUserId(), req.getOldPassword(), req.getNewPassword());
+        return Result.ok();
+    }
+}
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/BannerController.java b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/BannerController.java
new file mode 100644
index 0000000..292b3b4
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/BannerController.java
@@ -0,0 +1,86 @@
+package com.reelshort.admin.controller;
+
+import com.reelshort.common.pojo.PageResult;
+import com.reelshort.common.pojo.Result;
+import com.reelshort.content.service.BannerService;
+import com.reelshort.content.vo.BannerRespVO;
+import com.reelshort.content.vo.BannerSaveReqVO;
+import com.reelshort.framework.security.SecurityUtils;
+import com.reelshort.framework.log.OperationLog;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+import java.util.Map;
+
+@RestController
+@RequestMapping("/admin/banners")
+@RequiredArgsConstructor
+public class BannerController {
+
+    private final BannerService bannerService;
+
+    @GetMapping("/page")
+    @PreAuthorize("@ss.hasPermission('banner:list')")
+    public Result<PageResult<BannerRespVO>> page(@RequestParam(required = false) String position,
+                                                 @RequestParam(required = false) Integer status,
+                                                 @RequestParam(defaultValue = "1") Integer pageIndex,
+                                                 @RequestParam(defaultValue = "10") Integer pageSize) {
+        return Result.ok(bannerService.page(position, status, pageIndex, pageSize));
+    }
+
+    @GetMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('banner:list')")
+    public Result<BannerRespVO> get(@PathVariable Long id) {
+        return Result.ok(bannerService.get(id));
+    }
+
+    @PostMapping
+    @PreAuthorize("@ss.hasPermission('banner:create')")
+    @OperationLog(module = "内容管理", action = "新增轮播图")
+    public Result<Long> create(@Valid @RequestBody BannerSaveReqVO req) {
+        return Result.ok(bannerService.create(req, SecurityUtils.getUserId()));
+    }
+
+    @PutMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('banner:update')")
+    @OperationLog(module = "内容管理", action = "编辑轮播图")
+    public Result<Void> update(@PathVariable Long id, @Valid @RequestBody BannerSaveReqVO req) {
+        bannerService.update(id, req);
+        return Result.ok();
+    }
+
+    @DeleteMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('banner:delete')")
+    @OperationLog(module = "内容管理", action = "删除轮播图")
+    public Result<Void> delete(@PathVariable Long id) {
+        bannerService.delete(id);
+        return Result.ok();
+    }
+
+    @PutMapping("/{id}/status")
+    @PreAuthorize("@ss.hasPermission('banner:update')")
+    @OperationLog(module = "内容管理", action = "修改轮播图状态")
+    public Result<Void> updateStatus(@PathVariable Long id, @RequestParam Integer status) {
+        bannerService.updateStatus(id, status);
+        return Result.ok();
+    }
+
+    @PutMapping("/sort")
+    @PreAuthorize("@ss.hasPermission('banner:update')")
+    public Result<Void> sort(@RequestBody Map<String, List<Long>> body) {
+        bannerService.updateSort(body.getOrDefault("ids", List.of()));
+        return Result.ok();
+    }
+
+}
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/ConfigController.java b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/ConfigController.java
new file mode 100644
index 0000000..b0bddcb
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/ConfigController.java
@@ -0,0 +1,38 @@
+package com.reelshort.admin.controller;
+
+import com.reelshort.common.pojo.Result;
+import com.reelshort.system.service.ConfigService;
+import com.reelshort.framework.log.OperationLog;
+import com.reelshort.system.vo.ConfigItemVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+import java.util.Map;
+
+@RestController
+@RequestMapping("/admin/configs")
+@RequiredArgsConstructor
+public class ConfigController {
+
+    private final ConfigService configService;
+
+    @GetMapping
+    @PreAuthorize("@ss.hasAnyPermission('system:role','system:menu')")
+    public Result<List<ConfigItemVO>> list() {
+        return Result.ok(configService.list());
+    }
+
+    @PutMapping
+    @PreAuthorize("@ss.hasPermission('system:role')")
+    @OperationLog(module = "后台管理", action = "修改系统设置")
+    public Result<Void> update(@RequestBody Map<String, String> values) {
+        configService.update(values);
+        return Result.ok();
+    }
+}
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/DictController.java b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/DictController.java
new file mode 100644
index 0000000..1149235
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/DictController.java
@@ -0,0 +1,40 @@
+package com.reelshort.admin.controller;
+
+import com.reelshort.common.pojo.Result;
+import com.reelshort.content.enums.ContentStatus;
+import com.reelshort.content.service.DramaCategoryService;
+import com.reelshort.content.vo.DramaCategoryRespVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * 字典接口：题材、内容状态等下拉数据。
+ */
+@RestController
+@RequestMapping("/admin/dicts")
+@RequiredArgsConstructor
+public class DictController {
+
+    private final DramaCategoryService dramaCategoryService;
+
+    @GetMapping("/drama-category")
+    @PreAuthorize("@ss.hasPermission('drama:list')")
+    public Result<List<DramaCategoryRespVO>> dramaCategories() {
+        return Result.ok(dramaCategoryService.list());
+    }
+
+    @GetMapping("/content-status")
+    @PreAuthorize("@ss.hasPermission('drama:list')")
+    public Result<List<Map<String, String>>> contentStatus() {
+        return Result.ok(Arrays.stream(ContentStatus.values())
+                .map(status -> Map.of("code", status.getCode(), "text", status.getText()))
+                .toList());
+    }
+}
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/DramaCategoryController.java b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/DramaCategoryController.java
new file mode 100644
index 0000000..1afd6e1
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/DramaCategoryController.java
@@ -0,0 +1,61 @@
+package com.reelshort.admin.controller;
+
+import com.reelshort.common.pojo.Result;
+import com.reelshort.content.service.DramaCategoryService;
+import com.reelshort.content.vo.DramaCategoryRespVO;
+import com.reelshort.content.vo.DramaCategorySaveReqVO;
+import com.reelshort.framework.security.SecurityUtils;
+import com.reelshort.framework.log.OperationLog;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+
+/**
+ * 短剧类型管理。类型属于短剧域，权限沿用 drama:*，不再单开权限点。
+ */
+@RestController
+@RequestMapping("/admin/drama-categories")
+@RequiredArgsConstructor
+public class DramaCategoryController {
+
+    private final DramaCategoryService dramaCategoryService;
+
+    @GetMapping
+    @PreAuthorize("@ss.hasPermission('drama:list')")
+    public Result<List<DramaCategoryRespVO>> list() {
+        return Result.ok(dramaCategoryService.list());
+    }
+
+    @PostMapping
+    @PreAuthorize("@ss.hasPermission('drama:create')")
+    @OperationLog(module = "内容管理", action = "新增短剧类型")
+    public Result<Long> create(@Valid @RequestBody DramaCategorySaveReqVO req) {
+        return Result.ok(dramaCategoryService.create(req));
+    }
+
+    @PutMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('drama:update')")
+    @OperationLog(module = "内容管理", action = "编辑短剧类型")
+    public Result<Void> update(@PathVariable Long id, @Valid @RequestBody DramaCategorySaveReqVO req) {
+        dramaCategoryService.update(id, req);
+        return Result.ok();
+    }
+
+    @DeleteMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('drama:delete')")
+    @OperationLog(module = "内容管理", action = "删除短剧类型")
+    public Result<Void> delete(@PathVariable Long id) {
+        dramaCategoryService.delete(id);
+        return Result.ok();
+    }
+}
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/DramaController.java b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/DramaController.java
new file mode 100644
index 0000000..b32bc05
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/DramaController.java
@@ -0,0 +1,120 @@
+package com.reelshort.admin.controller;
+
+import com.reelshort.common.pojo.PageResult;
+import com.reelshort.common.pojo.Result;
+import com.reelshort.content.dal.entity.DramaReviewRecord;
+import com.reelshort.content.service.DramaService;
+import com.reelshort.content.vo.DramaPageReqVO;
+import com.reelshort.content.vo.DramaRespVO;
+import com.reelshort.content.vo.DramaSaveReqVO;
+import com.reelshort.content.vo.DramaStatusReqVO;
+import com.reelshort.framework.security.SecurityUtils;
+import com.reelshort.framework.log.OperationLog;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+
+@RestController
+@RequestMapping("/admin/dramas")
+@RequiredArgsConstructor
+public class DramaController {
+
+    private final DramaService dramaService;
+
+    @GetMapping("/page")
+    @PreAuthorize("@ss.hasPermission('drama:list')")
+    public Result<PageResult<DramaRespVO>> page(DramaPageReqVO req) {
+        return Result.ok(dramaService.page(req));
+    }
+
+    @GetMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('drama:list')")
+    public Result<DramaRespVO> get(@PathVariable Long id) {
+        return Result.ok(dramaService.get(id));
+    }
+
+    @PostMapping
+    @PreAuthorize("@ss.hasPermission('drama:create')")
+    @OperationLog(module = "内容管理", action = "新建短剧")
+    public Result<Long> create(@Valid @RequestBody DramaSaveReqVO req) {
+        return Result.ok(dramaService.create(req, SecurityUtils.getUserId()));
+    }
+
+    @PutMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('drama:update')")
+    @OperationLog(module = "内容管理", action = "编辑短剧")
+    public Result<Void> update(@PathVariable Long id, @Valid @RequestBody DramaSaveReqVO req) {
+        dramaService.update(id, req);
+        return Result.ok();
+    }
+
+    @DeleteMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('drama:delete')")
+    @OperationLog(module = "内容管理", action = "删除短剧")
+    public Result<Void> delete(@PathVariable Long id) {
+        dramaService.delete(id);
+        return Result.ok();
+    }
+
+    /** 提交审核：内容运营即可操作。 */
+    @PostMapping("/{id}/submit")
+    @PreAuthorize("@ss.hasAnyPermission('drama:review','drama:update')")
+    @OperationLog(module = "内容管理", action = "提交审核")
+    public Result<Void> submit(@PathVariable Long id, @RequestBody(required = false) DramaStatusReqVO req) {
+        changeStatus(id, "SUBMIT", req);
+        return Result.ok();
+    }
+
+    @PostMapping("/{id}/approve")
+    @PreAuthorize("@ss.hasPermission('drama:review')")
+    @OperationLog(module = "内容管理", action = "审核通过")
+    public Result<Void> approve(@PathVariable Long id, @RequestBody(required = false) DramaStatusReqVO req) {
+        changeStatus(id, "APPROVE", req);
+        return Result.ok();
+    }
+
+    @PostMapping("/{id}/reject")
+    @PreAuthorize("@ss.hasPermission('drama:review')")
+    @OperationLog(module = "内容管理", action = "驳回短剧")
+    public Result<Void> reject(@PathVariable Long id, @RequestBody(required = false) DramaStatusReqVO req) {
+        changeStatus(id, "REJECT", req);
+        return Result.ok();
+    }
+
+    @PostMapping("/{id}/publish")
+    @PreAuthorize("@ss.hasPermission('drama:review')")
+    @OperationLog(module = "内容管理", action = "短剧上线")
+    public Result<Void> publish(@PathVariable Long id, @RequestBody(required = false) DramaStatusReqVO req) {
+        changeStatus(id, "PUBLISH", req);
+        return Result.ok();
+    }
+
+    @PostMapping("/{id}/offline")
+    @PreAuthorize("@ss.hasPermission('drama:review')")
+    @OperationLog(module = "内容管理", action = "短剧下线")
+    public Result<Void> offline(@PathVariable Long id, @RequestBody(required = false) DramaStatusReqVO req) {
+        changeStatus(id, "OFFLINE", req);
+        return Result.ok();
+    }
+
+    @GetMapping("/{id}/review-records")
+    @PreAuthorize("@ss.hasPermission('drama:list')")
+    public Result<List<DramaReviewRecord>> reviewRecords(@PathVariable Long id) {
+        return Result.ok(dramaService.listReviewRecords(id));
+    }
+
+    private void changeStatus(Long id, String action, DramaStatusReqVO req) {
+        dramaService.changeStatus(id, action, req == null ? null : req.getReason(),
+                SecurityUtils.getUserId(), SecurityUtils.getUsername());
+    }
+}
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/EpisodeController.java b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/EpisodeController.java
new file mode 100644
index 0000000..cf2b569
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/EpisodeController.java
@@ -0,0 +1,68 @@
+package com.reelshort.admin.controller;
+
+import com.reelshort.common.pojo.Result;
+import com.reelshort.content.service.EpisodeService;
+import com.reelshort.content.vo.EpisodeRespVO;
+import com.reelshort.content.vo.EpisodeSaveReqVO;
+import com.reelshort.content.vo.EpisodeSortReqVO;
+import com.reelshort.framework.log.OperationLog;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+
+@RestController
+@RequestMapping("/admin/episodes")
+@RequiredArgsConstructor
+public class EpisodeController {
+
+    private final EpisodeService episodeService;
+
+    @GetMapping
+    @PreAuthorize("@ss.hasPermission('episode:list')")
+    public Result<List<EpisodeRespVO>> list(@RequestParam Long dramaId,
+                                            @RequestParam(required = false) String status) {
+        return Result.ok(episodeService.listByDrama(dramaId, status));
+    }
+
+    @PostMapping
+    @PreAuthorize("@ss.hasPermission('episode:upload')")
+    @OperationLog(module = "内容管理", action = "新增剧集")
+    public Result<Long> create(@Valid @RequestBody EpisodeSaveReqVO req) {
+        return Result.ok(episodeService.create(req));
+    }
+
+    @PutMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('episode:upload')")
+    @OperationLog(module = "内容管理", action = "编辑剧集")
+    public Result<Void> update(@PathVariable Long id, @Valid @RequestBody EpisodeSaveReqVO req) {
+        episodeService.update(id, req);
+        return Result.ok();
+    }
+
+    @DeleteMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('episode:upload')")
+    @OperationLog(module = "内容管理", action = "删除剧集")
+    public Result<Void> delete(@PathVariable Long id) {
+        episodeService.delete(id);
+        return Result.ok();
+    }
+
+    @PutMapping("/sort")
+    @PreAuthorize("@ss.hasPermission('episode:sort')")
+    @OperationLog(module = "内容管理", action = "调整剧集顺序")
+    public Result<Void> sort(@Valid @RequestBody EpisodeSortReqVO req) {
+        episodeService.updateSort(req.getIds());
+        return Result.ok();
+    }
+}
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/MediaController.java b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/MediaController.java
new file mode 100644
index 0000000..5347942
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/MediaController.java
@@ -0,0 +1,58 @@
+package com.reelshort.admin.controller;
+
+import com.reelshort.common.pojo.Result;
+import com.reelshort.framework.security.SecurityUtils;
+import com.reelshort.media.service.MediaService;
+import com.reelshort.media.vo.MediaAssetRespVO;
+import com.reelshort.media.vo.UploadCompleteReqVO;
+import com.reelshort.media.vo.UploadInitReqVO;
+import com.reelshort.media.vo.UploadInitRespVO;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.multipart.MultipartFile;
+
+/**
+ * 媒资上传（本地存储版）：init 建会话 → chunk 传分片 → complete 合并出地址。
+ */
+@RestController
+@RequestMapping("/admin/media")
+@RequiredArgsConstructor
+public class MediaController {
+
+    private final MediaService mediaService;
+
+    @PostMapping("/upload/init")
+    @PreAuthorize("@ss.hasAnyPermission('cover:upload','episode:upload')")
+    public Result<UploadInitRespVO> init(@Valid @RequestBody UploadInitReqVO req) {
+        return Result.ok(mediaService.init(req, SecurityUtils.getUserId()));
+    }
+
+    @PostMapping("/upload/chunk")
+    @PreAuthorize("@ss.hasAnyPermission('cover:upload','episode:upload')")
+    public Result<Integer> uploadChunk(@RequestParam String uploadId,
+                                       @RequestParam int index,
+                                       @RequestParam("file") MultipartFile file) {
+        mediaService.saveChunk(uploadId, index, file);
+        return Result.ok(index);
+    }
+
+    @PostMapping("/upload/complete")
+    @PreAuthorize("@ss.hasAnyPermission('cover:upload','episode:upload')")
+    public Result<MediaAssetRespVO> complete(@Valid @RequestBody UploadCompleteReqVO req) {
+        return Result.ok(mediaService.complete(req));
+    }
+
+    @GetMapping("/{id}")
+    @PreAuthorize("@ss.hasAnyPermission('cover:upload','episode:upload')")
+    public Result<MediaAssetRespVO> get(@PathVariable Long id) {
+        return Result.ok(mediaService.get(id));
+    }
+}
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/MenuController.java b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/MenuController.java
new file mode 100644
index 0000000..2b9eeb6
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/MenuController.java
@@ -0,0 +1,57 @@
+package com.reelshort.admin.controller;
+
+import com.reelshort.common.pojo.Result;
+import com.reelshort.system.service.MenuService;
+import com.reelshort.framework.log.OperationLog;
+import com.reelshort.system.vo.MenuSaveReqVO;
+import com.reelshort.system.vo.MenuVO;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+
+@RestController
+@RequestMapping("/admin/menus")
+@RequiredArgsConstructor
+public class MenuController {
+
+    private final MenuService menuService;
+
+    @GetMapping("/tree")
+    @PreAuthorize("@ss.hasPermission('system:menu')")
+    public Result<List<MenuVO>> tree() {
+        return Result.ok(menuService.listAll());
+    }
+
+    @PostMapping
+    @PreAuthorize("@ss.hasPermission('system:menu')")
+    @OperationLog(module = "后台管理", action = "新增菜单")
+    public Result<Long> create(@Valid @RequestBody MenuSaveReqVO req) {
+        return Result.ok(menuService.create(req));
+    }
+
+    @PutMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('system:menu')")
+    @OperationLog(module = "后台管理", action = "编辑菜单")
+    public Result<Void> update(@PathVariable Long id, @Valid @RequestBody MenuSaveReqVO req) {
+        menuService.update(id, req);
+        return Result.ok();
+    }
+
+    @DeleteMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('system:menu')")
+    @OperationLog(module = "后台管理", action = "删除菜单")
+    public Result<Void> delete(@PathVariable Long id) {
+        menuService.delete(id);
+        return Result.ok();
+    }
+}
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/OperationLogController.java b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/OperationLogController.java
new file mode 100644
index 0000000..22efb8d
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/OperationLogController.java
@@ -0,0 +1,33 @@
+package com.reelshort.admin.controller;
+
+import com.reelshort.common.pojo.PageResult;
+import com.reelshort.common.pojo.Result;
+import com.reelshort.system.service.OperationLogService;
+import com.reelshort.system.vo.OperationLogPageReqVO;
+import com.reelshort.system.vo.OperationLogRespVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/admin/operation-logs")
+@RequiredArgsConstructor
+public class OperationLogController {
+
+    private final OperationLogService operationLogService;
+
+    @GetMapping("/page")
+    @PreAuthorize("@ss.hasPermission('log:list')")
+    public Result<PageResult<OperationLogRespVO>> page(OperationLogPageReqVO req) {
+        return Result.ok(operationLogService.page(req));
+    }
+
+    @GetMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('log:list')")
+    public Result<OperationLogRespVO> get(@PathVariable Long id) {
+        return Result.ok(operationLogService.get(id));
+    }
+}
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/PermissionController.java b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/PermissionController.java
new file mode 100644
index 0000000..36ecde8
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/PermissionController.java
@@ -0,0 +1,27 @@
+package com.reelshort.admin.controller;
+
+import com.reelshort.common.pojo.Result;
+import com.reelshort.system.service.PermissionService;
+import com.reelshort.system.vo.PermissionGroupVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+
+@RestController
+@RequestMapping("/admin/permissions")
+@RequiredArgsConstructor
+public class PermissionController {
+
+    private final PermissionService permissionService;
+
+    /** 按分组返回权限点，直接喂给前端的角色权限配置页。 */
+    @GetMapping
+    @PreAuthorize("@ss.hasPermission('system:role')")
+    public Result<List<PermissionGroupVO>> groups() {
+        return Result.ok(permissionService.listGroups());
+    }
+}
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/RoleCategoryController.java b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/RoleCategoryController.java
new file mode 100644
index 0000000..b240212
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/RoleCategoryController.java
@@ -0,0 +1,57 @@
+package com.reelshort.admin.controller;
+
+import com.reelshort.common.pojo.Result;
+import com.reelshort.system.service.RoleCategoryService;
+import com.reelshort.framework.log.OperationLog;
+import com.reelshort.system.vo.RoleCategoryRespVO;
+import com.reelshort.system.vo.RoleCategorySaveReqVO;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+
+@RestController
+@RequestMapping("/admin/role-categories")
+@RequiredArgsConstructor
+public class RoleCategoryController {
+
+    private final RoleCategoryService roleCategoryService;
+
+    @GetMapping
+    @PreAuthorize("@ss.hasPermission('system:role-category')")
+    public Result<List<RoleCategoryRespVO>> list() {
+        return Result.ok(roleCategoryService.list());
+    }
+
+    @PostMapping
+    @PreAuthorize("@ss.hasPermission('system:role-category')")
+    @OperationLog(module = "后台管理", action = "新增角色分类")
+    public Result<Long> create(@Valid @RequestBody RoleCategorySaveReqVO req) {
+        return Result.ok(roleCategoryService.create(req));
+    }
+
+    @PutMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('system:role-category')")
+    @OperationLog(module = "后台管理", action = "编辑角色分类")
+    public Result<Void> update(@PathVariable Long id, @Valid @RequestBody RoleCategorySaveReqVO req) {
+        roleCategoryService.update(id, req);
+        return Result.ok();
+    }
+
+    @DeleteMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('system:role-category')")
+    @OperationLog(module = "后台管理", action = "删除角色分类")
+    public Result<Void> delete(@PathVariable Long id) {
+        roleCategoryService.delete(id);
+        return Result.ok();
+    }
+}
diff --git a/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/RoleController.java b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/RoleController.java
new file mode 100644
index 0000000..fde8ff6
--- /dev/null
+++ b/reelshort-admin-api/src/main/java/com/reelshort/admin/controller/RoleController.java
@@ -0,0 +1,88 @@
+package com.reelshort.admin.controller;
+
+import com.reelshort.common.pojo.PageResult;
+import com.reelshort.common.pojo.Result;
+import com.reelshort.system.service.RoleService;
+import com.reelshort.framework.log.OperationLog;
+import com.reelshort.system.vo.RolePermissionSaveReqVO;
+import com.reelshort.system.vo.RoleRespVO;
+import com.reelshort.system.vo.RoleSaveReqVO;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+
+@RestController
+@RequestMapping("/admin/roles")
+@RequiredArgsConstructor
+public class RoleController {
+
+    private final RoleService roleService;
+
+    @GetMapping("/page")
+    @PreAuthorize("@ss.hasPermission('system:role')")
+    public Result<PageResult<RoleRespVO>> page(@RequestParam(required = false) String keyword,
+                                               @RequestParam(defaultValue = "1") Integer pageIndex,
+                                               @RequestParam(defaultValue = "10") Integer pageSize) {
+        return Result.ok(roleService.page(keyword, pageIndex, pageSize));
+    }
+
+    @GetMapping("/list")
+    public Result<List<RoleRespVO>> list() {
+        return Result.ok(roleService.listAll());
+    }
+
+    @GetMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('system:role')")
+    public Result<RoleRespVO> get(@PathVariable Long id) {
+        return Result.ok(roleService.get(id));
+    }
+
+    @PostMapping
+    @PreAuthorize("@ss.hasPermission('system:role')")
+    @OperationLog(module = "后台管理", action = "新增角色")
+    public Result<Long> create(@Valid @RequestBody RoleSaveReqVO req) {
+        return Result.ok(roleService.create(req));
+    }
+
+    @PutMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('system:role')")
+    @OperationLog(module = "后台管理", action = "编辑角色")
+    public Result<Void> update(@PathVariable Long id, @Valid @RequestBody RoleSaveReqVO req) {
+        roleService.update(id, req);
+        return Result.ok();
+    }
+
+    @DeleteMapping("/{id}")
+    @PreAuthorize("@ss.hasPermission('system:role')")
+    @OperationLog(module = "后台管理", action = "删除角色")
+    public Result<Void> delete(@PathVariable Long id) {
+        roleService.delete(id);
+        return Result.ok();
+    }
+
+    @GetMapping("/{id}/permissions")
+    @PreAuthorize("@ss.hasPermission('system:role')")
+    public Result<List<String>> permissions(@PathVariable Long id) {
+        return Result.ok(roleService.listCodesByRoleId(id));
+    }
+
+    @PutMapping("/{id}/permissions")
+    @PreAuthorize("@ss.hasPermission('system:role')")
+    @OperationLog(module = "后台管理", action = "修改角色权限")
+    public Result<Void> updatePermissions(@PathVariable Long id,
+                                          @Valid @RequestBody RolePermissionSaveReqVO req) {
+        roleService.updatePermissions(id, req.getPermissions());
+        return Result.ok();
+    }
+}
diff --git a/reelshort-admin-api/src/main/resources/application.yml b/reelshort-admin-api/src/main/resources/application.yml
new file mode 100644
index 0000000..ca7491a
--- /dev/null
+++ b/reelshort-admin-api/src/main/resources/application.yml
@@ -0,0 +1,53 @@
+server:
+  port: 8080
+
+spring:
+  application:
+    name: reelshort-admin-api
+  autoconfigure:
+    exclude: org.springframework.boot.autoconfigure.security.servlet.UserDetailsServiceAutoConfiguration
+  datasource:
+    driver-class-name: org.postgresql.Driver
+    url: jdbc:postgresql://127.0.0.1:5432/reelshort
+    username: ${DB_USER:reelshort}
+    password: ${DB_PASSWORD:reelshort}
+  jackson:
+    date-format: yyyy-MM-dd HH:mm:ss
+    time-zone: Asia/Shanghai
+  servlet:
+    multipart:
+      # 分片上传，单个请求只需要容纳一个分片
+      max-file-size: 20MB
+      max-request-size: 20MB
+
+mybatis-plus:
+  configuration:
+    map-underscore-to-camel-case: true
+  global-config:
+    banner: false
+    db-config:
+      id-type: auto
+      logic-delete-field: deleted
+      logic-delete-value: 1
+      logic-not-delete-value: 0
+
+reelshort:
+  media:
+    # 本地媒资目录（相对应用启动目录），通过 /files/** 访问
+    root-dir: ./data/uploads
+    public-prefix: /files
+    chunk-size: 5242880
+    max-file-size: 2147483648
+  jwt:
+    admin-secret: ${JWT_ADMIN_SECRET:reelshort-admin-dev-secret-change-me-in-production-32b}
+    admin-ttl-hours: 12
+  cors:
+    allowed-origins: http://localhost:3005,http://127.0.0.1:3005
+
+springdoc:
+  swagger-ui:
+    path: /doc.html
+
+logging:
+  level:
+    com.reelshort: debug
diff --git a/reelshort-app-api/pom.xml b/reelshort-app-api/pom.xml
new file mode 100644
index 0000000..6960f9f
--- /dev/null
+++ b/reelshort-app-api/pom.xml
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>com.reelshort</groupId>
+        <artifactId>reelshort</artifactId>
+        <version>1.0.0-SNAPSHOT</version>
+    </parent>
+
+    <artifactId>reelshort-app-api</artifactId>
+    <name>reelshort-app-api</name>
+    <description>客户端接入层：/app/**</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>com.reelshort</groupId>
+            <artifactId>reelshort-module-content</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.reelshort</groupId>
+            <artifactId>reelshort-module-media</artifactId>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-maven-plugin</artifactId>
+            </plugin>
+        </plugins>
+    </build>
+</project>
diff --git a/reelshort-app-api/src/main/java/com/reelshort/app/AppApiApplication.java b/reelshort-app-api/src/main/java/com/reelshort/app/AppApiApplication.java
new file mode 100644
index 0000000..6028a7b
--- /dev/null
+++ b/reelshort-app-api/src/main/java/com/reelshort/app/AppApiApplication.java
@@ -0,0 +1,19 @@
+package com.reelshort.app;
+
+import org.mybatis.spring.annotation.MapperScan;
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+/**
+ * 客户端接口服务，只暴露 /app/** 与静态媒资 /files/**。
+ * 与 reelshort-admin-api 共用同一套领域模块和数据库，但入口、鉴权和限流策略独立。
+ */
+/* 显式指定扫描根包：本类在 com.reelshort.app 下，默认扫不到 content/system/framework 模块的 Bean */
+@SpringBootApplication(scanBasePackages = "com.reelshort")
+@MapperScan("com.reelshort.**.dal.mapper")
+public class AppApiApplication {
+
+    public static void main(String[] args) {
+        SpringApplication.run(AppApiApplication.class, args);
+    }
+}
diff --git a/reelshort-app-api/src/main/java/com/reelshort/app/controller/AppCatalogController.java b/reelshort-app-api/src/main/java/com/reelshort/app/controller/AppCatalogController.java
new file mode 100644
index 0000000..0ebb5a7
--- /dev/null
+++ b/reelshort-app-api/src/main/java/com/reelshort/app/controller/AppCatalogController.java
@@ -0,0 +1,38 @@
+package com.reelshort.app.controller;
+
+import com.reelshort.app.service.AppCatalogService;
+import com.reelshort.app.vo.AppCategoryVO;
+import com.reelshort.app.vo.AppFeedVO;
+import com.reelshort.common.pojo.Result;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+
+/**
+ * 客户端目录接口：首页与发现页各一次请求拿全量聚合数据。
+ */
+@RestController
+@RequestMapping("/app")
+@RequiredArgsConstructor
+public class AppCatalogController {
+
+    private final AppCatalogService appCatalogService;
+
+    @GetMapping("/home/feed")
+    public Result<AppFeedVO> homeFeed() {
+        return Result.ok(appCatalogService.homeFeed());
+    }
+
+    @GetMapping("/discover/feed")
+    public Result<AppFeedVO> discoverFeed() {
+        return Result.ok(appCatalogService.discoverFeed());
+    }
+
+    @GetMapping("/categories")
+    public Result<List<AppCategoryVO>> categories() {
+        return Result.ok(appCatalogService.categories());
+    }
+}
diff --git a/reelshort-app-api/src/main/java/com/reelshort/app/controller/AppDramaController.java b/reelshort-app-api/src/main/java/com/reelshort/app/controller/AppDramaController.java
new file mode 100644
index 0000000..ebda094
--- /dev/null
+++ b/reelshort-app-api/src/main/java/com/reelshort/app/controller/AppDramaController.java
@@ -0,0 +1,31 @@
+package com.reelshort.app.controller;
+
+import com.reelshort.app.service.AppCatalogService;
+import com.reelshort.app.vo.AppDramaDetailVO;
+import com.reelshort.app.vo.AppPlayTicketVO;
+import com.reelshort.common.pojo.Result;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/app")
+@RequiredArgsConstructor
+public class AppDramaController {
+
+    private final AppCatalogService appCatalogService;
+
+    /** 详情：包含剧集列表，客户端进详情页一次请求即可渲染 */
+    @GetMapping("/dramas/{id}")
+    public Result<AppDramaDetailVO> detail(@PathVariable Long id) {
+        return Result.ok(appCatalogService.dramaDetail(id));
+    }
+
+    /** 播放票据：返回可访问性与播放地址，未解锁时只返回需要多少金币 */
+    @GetMapping("/episodes/{id}/play")
+    public Result<AppPlayTicketVO> play(@PathVariable Long id) {
+        return Result.ok(appCatalogService.playTicket(id));
+    }
+}
diff --git a/reelshort-app-api/src/main/java/com/reelshort/app/service/AppCatalogService.java b/reelshort-app-api/src/main/java/com/reelshort/app/service/AppCatalogService.java
new file mode 100644
index 0000000..5f46175
--- /dev/null
+++ b/reelshort-app-api/src/main/java/com/reelshort/app/service/AppCatalogService.java
@@ -0,0 +1,211 @@
+package com.reelshort.app.service;
+
+import com.reelshort.app.vo.AppBannerVO;
+import com.reelshort.app.vo.AppCategoryVO;
+import com.reelshort.app.vo.AppDramaCardVO;
+import com.reelshort.app.vo.AppDramaDetailVO;
+import com.reelshort.app.vo.AppEpisodeVO;
+import com.reelshort.app.vo.AppFeedVO;
+import com.reelshort.app.vo.AppPlayTicketVO;
+import com.reelshort.app.vo.AppSectionVO;
+import com.reelshort.content.dal.entity.ContentBanner;
+import com.reelshort.content.dal.entity.Drama;
+import com.reelshort.content.dal.entity.DramaEpisode;
+import com.reelshort.content.enums.BannerPosition;
+import com.reelshort.content.service.BannerService;
+import com.reelshort.content.service.DramaCategoryService;
+import com.reelshort.content.service.DramaService;
+import com.reelshort.content.service.EpisodeService;
+import com.reelshort.content.vo.DramaCategoryRespVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * C 端目录聚合：把内容域的只读视图组装成客户端一次请求就能渲染的结构。
+ * 只读取已上线内容，运营状态、审核信息等管理端字段不下发。
+ */
+@Service
+@RequiredArgsConstructor
+public class AppCatalogService {
+
+    private static final int HOME_SECTION_SIZE = 6;
+    private static final int DISCOVER_SECTION_SIZE = 10;
+    private static final int MAX_CATEGORY_SECTIONS = 4;
+
+    private final DramaService dramaService;
+    private final EpisodeService episodeService;
+    private final BannerService bannerService;
+    private final DramaCategoryService dramaCategoryService;
+
+    public AppFeedVO homeFeed() {
+        Map<Long, String> categoryNames = categoryNameMap();
+        List<AppSectionVO> sections = new ArrayList<>();
+        addIfNotEmpty(sections, "hot", "热门推荐",
+                dramaService.listPublishedHot(HOME_SECTION_SIZE), categoryNames);
+        addIfNotEmpty(sections, "new", "新剧上线",
+                dramaService.listPublishedLatest(HOME_SECTION_SIZE), categoryNames);
+        sections.addAll(categorySections(HOME_SECTION_SIZE, categoryNames));
+        return new AppFeedVO(banners(BannerPosition.HOME_TOP.name()), sections);
+    }
+
+    public AppFeedVO discoverFeed() {
+        return new AppFeedVO(banners(BannerPosition.DISCOVER.name()),
+                categorySections(DISCOVER_SECTION_SIZE, categoryNameMap()));
+    }
+
+    public List<AppCategoryVO> categories() {
+        return dramaCategoryService.listBasic().stream()
+                .filter(category -> category.getStatus() == null || category.getStatus() == 1)
+                .map(category -> new AppCategoryVO(category.getId(), category.getName()))
+                .toList();
+    }
+
+    public AppDramaDetailVO dramaDetail(Long dramaId) {
+        Drama drama = dramaService.getPublished(dramaId);
+        List<DramaEpisode> episodes = episodeService.listPublishedByDrama(dramaId);
+        String categoryName = categoryNameMap().getOrDefault(drama.getCategoryId(), "");
+
+        AppDramaDetailVO detail = new AppDramaDetailVO();
+        detail.setId(drama.getId());
+        detail.setTitle(drama.getTitle());
+        detail.setSynopsis(drama.getSynopsis());
+        detail.setCover(drama.getCoverUrl());
+        detail.setGenre(drama.getGenre());
+        detail.setCategory(categoryName);
+        detail.setTotalEpisodes(drama.getTotalEpisodes());
+        detail.setFreeEpisodes(drama.getFreeEpisodes());
+        detail.setUnlockCoin(drama.getUnlockCoin());
+        detail.setIsHot(drama.getIsHot() != null && drama.getIsHot() == 1);
+        detail.setViewCount(drama.getViewCount());
+        detail.setEpisodes(episodes.stream().map(this::toEpisode).toList());
+        return detail;
+    }
+
+    /** 播放票据：目前免费集直接给地址，未解锁只返回需要多少金币 */
+    public AppPlayTicketVO playTicket(Long episodeId) {
+        DramaEpisode episode = episodeService.getPublished(episodeId);
+        dramaService.getPublished(episode.getDramaId());
+
+        boolean free = episode.getIsFree() != null && episode.getIsFree() == 1;
+        boolean hasMedia = episode.getVideoUrl() != null && !episode.getVideoUrl().isBlank();
+
+        AppPlayTicketVO ticket = new AppPlayTicketVO();
+        ticket.setEpisodeId(episode.getId());
+        ticket.setDramaId(episode.getDramaId());
+        ticket.setEpNo(episode.getEpNo());
+        ticket.setTitle(episode.getTitle());
+        ticket.setDurationSec(episode.getDurationSec());
+        ticket.setUnlockCoin(episode.getUnlockCoin());
+        if (!free) {
+            ticket.setAccessible(false);
+            ticket.setAccessType("COIN_REQUIRED");
+        } else if (!hasMedia) {
+            ticket.setAccessible(false);
+            ticket.setAccessType("NO_MEDIA");
+        } else {
+            ticket.setAccessible(true);
+            ticket.setAccessType("FREE");
+            ticket.setPlayUrl(episode.getVideoUrl());
+        }
+        return ticket;
+    }
+
+    private List<AppBannerVO> banners(String position) {
+        return bannerService.listActive(position).stream().map(this::toBanner).toList();
+    }
+
+    private List<AppSectionVO> categorySections(int size, Map<Long, String> categoryNames) {
+        List<AppSectionVO> sections = new ArrayList<>();
+        for (DramaCategoryRespVO category : dramaCategoryService.listBasic()) {
+            if (sections.size() >= MAX_CATEGORY_SECTIONS) {
+                break;
+            }
+            List<Drama> dramas = dramaService.listPublished(category.getId(), size);
+            if (!dramas.isEmpty()) {
+                sections.add(new AppSectionVO(
+                        "category-" + category.getId(),
+                        category.getName(),
+                        cards(dramas, categoryNames)));
+            }
+        }
+        return sections;
+    }
+
+    private void addIfNotEmpty(List<AppSectionVO> sections, String code, String title,
+                               List<Drama> dramas, Map<Long, String> categoryNames) {
+        if (!dramas.isEmpty()) {
+            sections.add(new AppSectionVO(code, title, cards(dramas, categoryNames)));
+        }
+    }
+
+    private AppBannerVO toBanner(ContentBanner banner) {
+        AppBannerVO vo = new AppBannerVO();
+        vo.setId(banner.getId());
+        vo.setImageUrl(banner.getImageUrl());
+        vo.setLinkType(banner.getLinkType());
+        vo.setLinkValue(banner.getLinkValue());
+        return vo;
+    }
+
+    /** 整屏卡片共用一次剧集查询，取每部剧的首个可播免费集作为预览。 */
+    private List<AppDramaCardVO> cards(List<Drama> dramas, Map<Long, String> categoryNames) {
+        Map<Long, DramaEpisode> previews = episodeService.firstPlayableByDramas(
+                dramas.stream().map(Drama::getId).toList());
+        return dramas.stream()
+                .map(drama -> toCard(drama, categoryNames, previews.get(drama.getId())))
+                .toList();
+    }
+
+    private AppDramaCardVO toCard(Drama drama, Map<Long, String> categoryNames,
+                                  DramaEpisode preview) {
+        AppDramaCardVO card = new AppDramaCardVO();
+        card.setId(drama.getId());
+        card.setTitle(drama.getTitle());
+        card.setCover(drama.getCoverUrl());
+        card.setSynopsis(shortSynopsis(drama.getSynopsis()));
+        card.setGenre(drama.getGenre());
+        card.setCategory(categoryNames.getOrDefault(drama.getCategoryId(), ""));
+        card.setTotalEpisodes(drama.getTotalEpisodes());
+        card.setIsHot(drama.getIsHot() != null && drama.getIsHot() == 1);
+        card.setViewCount(drama.getViewCount());
+        card.setPreview(preview == null ? null : toEpisode(preview));
+        return card;
+    }
+
+    private AppEpisodeVO toEpisode(DramaEpisode episode) {
+        AppEpisodeVO vo = new AppEpisodeVO();
+        vo.setId(episode.getId());
+        vo.setNumber(episode.getEpNo());
+        vo.setTitle(episode.getTitle());
+        vo.setDurationSec(episode.getDurationSec());
+        int seconds = episode.getDurationSec() == null ? 0 : episode.getDurationSec();
+        vo.setDuration(String.format("%02d:%02d", seconds / 60, seconds % 60));
+        boolean free = episode.getIsFree() != null && episode.getIsFree() == 1;
+        vo.setIsFree(free);
+        vo.setLocked(!free);
+        vo.setUnlockCoin(episode.getUnlockCoin());
+        if (free && episode.getVideoUrl() != null && !episode.getVideoUrl().isBlank()) {
+            vo.setPlayUrl(episode.getVideoUrl());
+        }
+        return vo;
+    }
+
+    private Map<Long, String> categoryNameMap() {
+        Map<Long, String> names = new HashMap<>();
+        dramaCategoryService.listBasic().forEach(category -> names.put(category.getId(), category.getName()));
+        return names;
+    }
+
+    /** 卡片只带一句简介，避免列表响应体过大 */
+    private String shortSynopsis(String synopsis) {
+        if (synopsis == null) {
+            return "";
+        }
+        return synopsis.length() <= 60 ? synopsis : synopsis.substring(0, 60);
+    }
+}
diff --git a/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppBannerVO.java b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppBannerVO.java
new file mode 100644
index 0000000..71af5a2
--- /dev/null
+++ b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppBannerVO.java
@@ -0,0 +1,14 @@
+package com.reelshort.app.vo;
+
+import lombok.Data;
+
+@Data
+public class AppBannerVO {
+
+    private Long id;
+    private String imageUrl;
+    /** NONE / DRAMA / URL */
+    private String linkType;
+    /** 短剧 ID 或跳转地址 */
+    private String linkValue;
+}
diff --git a/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppCategoryVO.java b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppCategoryVO.java
new file mode 100644
index 0000000..8a120d3
--- /dev/null
+++ b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppCategoryVO.java
@@ -0,0 +1,12 @@
+package com.reelshort.app.vo;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+
+@Data
+@AllArgsConstructor
+public class AppCategoryVO {
+
+    private Long id;
+    private String name;
+}
diff --git a/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppDramaCardVO.java b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppDramaCardVO.java
new file mode 100644
index 0000000..387904e
--- /dev/null
+++ b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppDramaCardVO.java
@@ -0,0 +1,23 @@
+package com.reelshort.app.vo;
+
+import lombok.Data;
+
+/** 列表卡片，用于首页/发现页/分类分区 */
+@Data
+public class AppDramaCardVO {
+
+    private Long id;
+    private String title;
+    private String cover;
+    private String synopsis;
+    private String genre;
+    private String category;
+    private Integer totalEpisodes;
+    private Boolean isHot;
+    private Long viewCount;
+    /**
+     * 首个可播免费集。首页竖屏播放需要在列表阶段就能起播，
+     * 带上这一集可以省掉「点开→请求详情→再请求播放地址」的往返。
+     */
+    private AppEpisodeVO preview;
+}
diff --git a/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppDramaDetailVO.java b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppDramaDetailVO.java
new file mode 100644
index 0000000..86fe279
--- /dev/null
+++ b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppDramaDetailVO.java
@@ -0,0 +1,22 @@
+package com.reelshort.app.vo;
+
+import lombok.Data;
+
+import java.util.List;
+
+@Data
+public class AppDramaDetailVO {
+
+    private Long id;
+    private String title;
+    private String synopsis;
+    private String cover;
+    private String genre;
+    private String category;
+    private Integer totalEpisodes;
+    private Integer freeEpisodes;
+    private Integer unlockCoin;
+    private Boolean isHot;
+    private Long viewCount;
+    private List<AppEpisodeVO> episodes;
+}
diff --git a/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppEpisodeVO.java b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppEpisodeVO.java
new file mode 100644
index 0000000..d7b9d18
--- /dev/null
+++ b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppEpisodeVO.java
@@ -0,0 +1,23 @@
+package com.reelshort.app.vo;
+
+import lombok.Data;
+
+@Data
+public class AppEpisodeVO {
+
+    private Long id;
+    private Integer number;
+    private String title;
+    /** 展示用时长 mm:ss */
+    private String duration;
+    private Integer durationSec;
+    private Boolean isFree;
+    /** true 表示需要解锁后才能播放 */
+    private Boolean locked;
+    private Integer unlockCoin;
+    /**
+     * 可播放时的地址；锁定或不含片源时为空。
+     * 详情页拿到就能直接播，不必按集再请求一次播放票据。
+     */
+    private String playUrl;
+}
diff --git a/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppFeedVO.java b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppFeedVO.java
new file mode 100644
index 0000000..c5e2e63
--- /dev/null
+++ b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppFeedVO.java
@@ -0,0 +1,15 @@
+package com.reelshort.app.vo;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+
+import java.util.List;
+
+/** 首页/发现页聚合响应：一次请求拿到轮播与所有分区，减少客户端往返 */
+@Data
+@AllArgsConstructor
+public class AppFeedVO {
+
+    private List<AppBannerVO> banners;
+    private List<AppSectionVO> sections;
+}
diff --git a/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppPlayTicketVO.java b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppPlayTicketVO.java
new file mode 100644
index 0000000..58dd616
--- /dev/null
+++ b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppPlayTicketVO.java
@@ -0,0 +1,20 @@
+package com.reelshort.app.vo;
+
+import lombok.Data;
+
+/** 播放票据：客户端据此决定直接播放还是弹解锁 */
+@Data
+public class AppPlayTicketVO {
+
+    private Long episodeId;
+    private Long dramaId;
+    private Integer epNo;
+    private String title;
+    private Integer durationSec;
+    private Boolean accessible;
+    /** FREE / COIN_REQUIRED / VIP_REQUIRED / NO_MEDIA */
+    private String accessType;
+    private Integer unlockCoin;
+    /** 可访问时的播放地址（相对路径，客户端拼上服务地址） */
+    private String playUrl;
+}
diff --git a/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppSectionVO.java b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppSectionVO.java
new file mode 100644
index 0000000..a9025eb
--- /dev/null
+++ b/reelshort-app-api/src/main/java/com/reelshort/app/vo/AppSectionVO.java
@@ -0,0 +1,17 @@
+package com.reelshort.app.vo;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+
+import java.util.List;
+
+/** 首页/发现页的一个横滑分区 */
+@Data
+@AllArgsConstructor
+public class AppSectionVO {
+
+    /** 分区标识：hot / new / category-{id}，客户端可据此做埋点与样式 */
+    private String code;
+    private String title;
+    private List<AppDramaCardVO> dramas;
+}
diff --git a/reelshort-app-api/src/main/resources/application.yml b/reelshort-app-api/src/main/resources/application.yml
new file mode 100644
index 0000000..f5a33fb
--- /dev/null
+++ b/reelshort-app-api/src/main/resources/application.yml
@@ -0,0 +1,43 @@
+server:
+  port: 8081
+
+spring:
+  application:
+    name: reelshort-app-api
+  autoconfigure:
+    exclude: org.springframework.boot.autoconfigure.security.servlet.UserDetailsServiceAutoConfiguration
+  datasource:
+    driver-class-name: org.postgresql.Driver
+    url: jdbc:postgresql://127.0.0.1:5432/reelshort
+    username: ${DB_USER:reelshort}
+    password: ${DB_PASSWORD:reelshort}
+  jackson:
+    date-format: yyyy-MM-dd HH:mm:ss
+    time-zone: Asia/Shanghai
+
+mybatis-plus:
+  configuration:
+    map-underscore-to-camel-case: true
+  global-config:
+    banner: false
+    db-config:
+      id-type: auto
+      logic-delete-field: deleted
+      logic-delete-value: 1
+      logic-not-delete-value: 0
+
+reelshort:
+  media:
+    root-dir: ./data/uploads
+    public-prefix: /files
+    chunk-size: 5242880
+    max-file-size: 2147483648
+  jwt:
+    admin-secret: ${JWT_ADMIN_SECRET:reelshort-admin-dev-secret-change-me-in-production-32b}
+    admin-ttl-hours: 12
+  cors:
+    allowed-origins: "*"
+
+logging:
+  level:
+    com.reelshort: info
diff --git a/reelshort-common/pom.xml b/reelshort-common/pom.xml
new file mode 100644
index 0000000..5a2966c
--- /dev/null
+++ b/reelshort-common/pom.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>com.reelshort</groupId>
+        <artifactId>reelshort</artifactId>
+        <version>1.0.0-SNAPSHOT</version>
+    </parent>
+
+    <artifactId>reelshort-common</artifactId>
+    <name>reelshort-common</name>
+    <description>通用模块：统一响应、分页、异常、工具</description>
+</project>
diff --git a/reelshort-common/src/main/java/com/reelshort/common/exception/ErrorCode.java b/reelshort-common/src/main/java/com/reelshort/common/exception/ErrorCode.java
new file mode 100644
index 0000000..8262e83
--- /dev/null
+++ b/reelshort-common/src/main/java/com/reelshort/common/exception/ErrorCode.java
@@ -0,0 +1,39 @@
+package com.reelshort.common.exception;
+
+import lombok.Getter;
+
+/**
+ * 全局错误码，详见 docs/architecture-design.md 附录 A。
+ */
+@Getter
+public enum ErrorCode {
+
+    SUCCESS(0, "ok"),
+
+    BAD_REQUEST(400, "参数校验失败"),
+    UNAUTHORIZED(401, "未登录或登录已过期"),
+    FORBIDDEN(403, "无权限"),
+    NOT_FOUND(404, "资源不存在"),
+    TOO_MANY_REQUESTS(429, "请求过于频繁"),
+    INTERNAL_ERROR(500, "系统异常"),
+
+    LOGIN_FAILED(100000, "账号或密码错误"),
+    ACCOUNT_DISABLED(100001, "账号已停用"),
+    COIN_NOT_ENOUGH(100002, "金币余额不足"),
+    EPISODE_NOT_AVAILABLE(100003, "剧集未发布或不存在"),
+    EPISODE_UNLOCKED(100004, "剧集已解锁"),
+    ORDER_STATUS_INVALID(100005, "订单已支付或已关闭"),
+    VIP_EXPIRED(100006, "VIP 已过期"),
+
+    DATA_EXISTS(200001, "数据已存在"),
+    DATA_NOT_FOUND(200002, "数据不存在"),
+    OPERATION_NOT_ALLOWED(200003, "当前状态不允许该操作");
+
+    private final int code;
+    private final String message;
+
+    ErrorCode(int code, String message) {
+        this.code = code;
+        this.message = message;
+    }
+}
diff --git a/reelshort-common/src/main/java/com/reelshort/common/exception/ServiceException.java b/reelshort-common/src/main/java/com/reelshort/common/exception/ServiceException.java
new file mode 100644
index 0000000..4c3e153
--- /dev/null
+++ b/reelshort-common/src/main/java/com/reelshort/common/exception/ServiceException.java
@@ -0,0 +1,31 @@
+package com.reelshort.common.exception;
+
+import lombok.Getter;
+
+/**
+ * 业务异常：带业务错误码，由全局异常处理器转成统一响应。
+ */
+@Getter
+public class ServiceException extends RuntimeException {
+
+    private final int code;
+
+    public ServiceException(ErrorCode errorCode) {
+        super(errorCode.getMessage());
+        this.code = errorCode.getCode();
+    }
+
+    public ServiceException(ErrorCode errorCode, String message) {
+        super(message);
+        this.code = errorCode.getCode();
+    }
+
+    public ServiceException(String message) {
+        super(message);
+        this.code = ErrorCode.INTERNAL_ERROR.getCode();
+    }
+
+    public static ServiceException of(ErrorCode errorCode) {
+        return new ServiceException(errorCode);
+    }
+}
diff --git a/reelshort-common/src/main/java/com/reelshort/common/pojo/PageParam.java b/reelshort-common/src/main/java/com/reelshort/common/pojo/PageParam.java
new file mode 100644
index 0000000..59543bb
--- /dev/null
+++ b/reelshort-common/src/main/java/com/reelshort/common/pojo/PageParam.java
@@ -0,0 +1,30 @@
+package com.reelshort.common.pojo;
+
+import lombok.Data;
+
+/**
+ * 分页请求参数，pageIndex 从 1 开始，与前端一致。
+ */
+@Data
+public class PageParam {
+
+    private static final int MAX_PAGE_SIZE = 200;
+
+    private Integer pageIndex = 1;
+    private Integer pageSize = 10;
+
+    public long getOffset() {
+        return (long) (getSafePageIndex() - 1) * getSafePageSize();
+    }
+
+    public int getSafePageIndex() {
+        return pageIndex == null || pageIndex < 1 ? 1 : pageIndex;
+    }
+
+    public int getSafePageSize() {
+        if (pageSize == null || pageSize < 1) {
+            return 10;
+        }
+        return Math.min(pageSize, MAX_PAGE_SIZE);
+    }
+}
diff --git a/reelshort-common/src/main/java/com/reelshort/common/pojo/PageResult.java b/reelshort-common/src/main/java/com/reelshort/common/pojo/PageResult.java
new file mode 100644
index 0000000..12bb6b4
--- /dev/null
+++ b/reelshort-common/src/main/java/com/reelshort/common/pojo/PageResult.java
@@ -0,0 +1,21 @@
+package com.reelshort.common.pojo;
+
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+
+import java.util.List;
+
+/**
+ * 分页响应，字段名与前端表格组件（total / list）保持一致。
+ */
+@Getter
+@AllArgsConstructor
+public class PageResult<T> {
+
+    private final long total;
+    private final List<T> list;
+
+    public static <T> PageResult<T> empty() {
+        return new PageResult<>(0L, List.of());
+    }
+}
diff --git a/reelshort-common/src/main/java/com/reelshort/common/pojo/Result.java b/reelshort-common/src/main/java/com/reelshort/common/pojo/Result.java
new file mode 100644
index 0000000..1e0e7f4
--- /dev/null
+++ b/reelshort-common/src/main/java/com/reelshort/common/pojo/Result.java
@@ -0,0 +1,37 @@
+package com.reelshort.common.pojo;
+
+import com.reelshort.common.exception.ErrorCode;
+import lombok.Getter;
+
+/**
+ * 统一响应体，与前端 axios 拦截器约定一致：{ code, message, data }。
+ */
+@Getter
+public class Result<T> {
+
+    private final int code;
+    private final String message;
+    private final T data;
+
+    private Result(int code, String message, T data) {
+        this.code = code;
+        this.message = message;
+        this.data = data;
+    }
+
+    public static Result<Void> ok() {
+        return new Result<>(ErrorCode.SUCCESS.getCode(), ErrorCode.SUCCESS.getMessage(), null);
+    }
+
+    public static <T> Result<T> ok(T data) {
+        return new Result<>(ErrorCode.SUCCESS.getCode(), ErrorCode.SUCCESS.getMessage(), data);
+    }
+
+    public static <T> Result<T> error(ErrorCode errorCode) {
+        return new Result<>(errorCode.getCode(), errorCode.getMessage(), null);
+    }
+
+    public static <T> Result<T> error(int code, String message) {
+        return new Result<>(code, message, null);
+    }
+}
diff --git a/reelshort-framework/pom.xml b/reelshort-framework/pom.xml
new file mode 100644
index 0000000..d236f8a
--- /dev/null
+++ b/reelshort-framework/pom.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>com.reelshort</groupId>
+        <artifactId>reelshort</artifactId>
+        <version>1.0.0-SNAPSHOT</version>
+    </parent>
+
+    <artifactId>reelshort-framework</artifactId>
+    <name>reelshort-framework</name>
+    <description>技术框架：安全、鉴权、持久层、Web 配置</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>com.reelshort</groupId>
+            <artifactId>reelshort-common</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-validation</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-aop</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>com.baomidou</groupId>
+            <artifactId>mybatis-plus-spring-boot3-starter</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.postgresql</groupId>
+            <artifactId>postgresql</artifactId>
+            <scope>runtime</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-impl</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-jackson</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springdoc</groupId>
+            <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
+        </dependency>
+    </dependencies>
+</project>
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/config/MybatisPlusConfig.java b/reelshort-framework/src/main/java/com/reelshort/framework/config/MybatisPlusConfig.java
new file mode 100644
index 0000000..f8cfb90
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/config/MybatisPlusConfig.java
@@ -0,0 +1,18 @@
+package com.reelshort.framework.config;
+
+import com.baomidou.mybatisplus.annotation.DbType;
+import com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor;
+import com.baomidou.mybatisplus.extension.plugins.inner.PaginationInnerInterceptor;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+public class MybatisPlusConfig {
+
+    @Bean
+    public MybatisPlusInterceptor mybatisPlusInterceptor() {
+        MybatisPlusInterceptor interceptor = new MybatisPlusInterceptor();
+        interceptor.addInnerInterceptor(new PaginationInnerInterceptor(DbType.POSTGRE_SQL));
+        return interceptor;
+    }
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/log/AccessDeniedRecorder.java b/reelshort-framework/src/main/java/com/reelshort/framework/log/AccessDeniedRecorder.java
new file mode 100644
index 0000000..12af8af
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/log/AccessDeniedRecorder.java
@@ -0,0 +1,58 @@
+package com.reelshort.framework.log;
+
+import com.reelshort.framework.security.LoginUser;
+import com.reelshort.framework.security.SecurityUtils;
+import com.reelshort.framework.web.WebUtils;
+import jakarta.servlet.http.HttpServletRequest;
+import lombok.RequiredArgsConstructor;
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.stereotype.Component;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+
+/**
+ * 越权访问留痕。
+ * 方法级鉴权（@PreAuthorize）抛出的异常走全局异常处理，过滤器级的走安全入口，
+ * 两处都调用这里，避免逻辑重复。
+ */
+@Component
+@RequiredArgsConstructor
+public class AccessDeniedRecorder {
+
+    private final ObjectProvider<OperationLogSink> sinkProvider;
+
+    public void record(HttpServletRequest request) {
+        OperationLogSink sink = sinkProvider.getIfAvailable();
+        if (sink == null) {
+            return;
+        }
+        LoginUser loginUser = null;
+        try {
+            loginUser = SecurityUtils.getLoginUser();
+        } catch (Exception ignored) {
+            // 未登录时没有登录态
+        }
+        sink.save(OperationLogEntry.builder()
+                .userId(loginUser == null ? 0L : loginUser.userId())
+                .username(loginUser == null ? "" : loginUser.username())
+                .module("安全")
+                .action("越权访问被拒绝")
+                .requestMethod(request == null ? "" : request.getMethod())
+                .requestUrl(request == null ? "" : request.getRequestURI())
+                .requestParams(request == null || request.getQueryString() == null
+                        ? "" : request.getQueryString())
+                .responseBody("{\"code\":403,\"message\":\"无权限\"}")
+                .status("FAIL")
+                .errorMsg("无权限")
+                .durationMs(0)
+                .ip(request == null ? "" : WebUtils.getClientIp(request))
+                .build());
+    }
+
+    /** 从当前线程取出请求，供全局异常处理使用。 */
+    public void recordCurrentRequest() {
+        if (RequestContextHolder.getRequestAttributes() instanceof ServletRequestAttributes attributes) {
+            record(attributes.getRequest());
+        }
+    }
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/log/OperationLog.java b/reelshort-framework/src/main/java/com/reelshort/framework/log/OperationLog.java
new file mode 100644
index 0000000..c7e6777
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/log/OperationLog.java
@@ -0,0 +1,21 @@
+package com.reelshort.framework.log;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * 标注在需要留痕的接口方法上。
+ * 请求参数、请求体、响应体、操作人、耗时、IP 由 {@link OperationLogAspect} 自动采集。
+ */
+@Target(ElementType.METHOD)
+@Retention(RetentionPolicy.RUNTIME)
+public @interface OperationLog {
+
+    /** 所属模块，如「内容管理」 */
+    String module() default "";
+
+    /** 动作名称，如「新增轮播图」 */
+    String action() default "";
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/log/OperationLogAspect.java b/reelshort-framework/src/main/java/com/reelshort/framework/log/OperationLogAspect.java
new file mode 100644
index 0000000..75434f1
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/log/OperationLogAspect.java
@@ -0,0 +1,151 @@
+package com.reelshort.framework.log;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.reelshort.framework.security.LoginUser;
+import com.reelshort.framework.security.SecurityUtils;
+import com.reelshort.framework.web.WebUtils;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.reflect.MethodSignature;
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.stereotype.Component;
+import org.springframework.validation.BindingResult;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+import org.springframework.web.multipart.MultipartFile;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.regex.Pattern;
+
+/**
+ * 自动记录后台写操作：谁、什么时候、调了哪个接口、传了什么、返回了什么、耗时多少。
+ */
+@Slf4j
+@Aspect
+@Component
+@RequiredArgsConstructor
+public class OperationLogAspect {
+
+    private static final int MAX_TEXT = 4000;
+    private static final String TRUNCATED = "\n...(已截断)";
+    /** 密码、密钥、令牌等不落库 */
+    private static final Pattern SENSITIVE_FIELDS = Pattern.compile(
+            "(?i)(\"(?:password|oldPassword|newPassword|confirmPassword|secret|token|accessToken|refreshToken)\"\\s*:\\s*)\"[^\"]*\"");
+
+    private final ObjectMapper objectMapper;
+    private final ObjectProvider<OperationLogSink> sinkProvider;
+
+    @Around("@annotation(operationLog)")
+    public Object around(ProceedingJoinPoint point, OperationLog operationLog) throws Throwable {
+        long started = System.currentTimeMillis();
+        Object result = null;
+        Throwable error = null;
+        try {
+            result = point.proceed();
+            return result;
+        } catch (Throwable ex) {
+            error = ex;
+            throw ex;
+        } finally {
+            try {
+                save(point, operationLog, result, error, (int) (System.currentTimeMillis() - started));
+            } catch (Exception ex) {
+                log.warn("写操作日志失败: {}", operationLog.action(), ex);
+            }
+        }
+    }
+
+    private void save(ProceedingJoinPoint point, OperationLog annotation, Object result,
+                      Throwable error, int durationMs) {
+        OperationLogSink sink = sinkProvider.getIfAvailable();
+        if (sink == null) {
+            return;
+        }
+        HttpServletRequest request = currentRequest();
+        LoginUser loginUser = currentUser();
+
+        sink.save(OperationLogEntry.builder()
+                .userId(loginUser == null ? 0L : loginUser.userId())
+                .username(loginUser == null ? "" : loginUser.username())
+                .module(annotation.module())
+                .action(annotation.action())
+                .requestMethod(request == null ? "" : request.getMethod())
+                .requestUrl(request == null ? "" : request.getRequestURI())
+                .requestParams(request == null ? "" : truncate(request.getQueryString()))
+                .requestBody(body(point))
+                .responseBody(error != null ? "" : json(result))
+                .status(error == null ? "SUCCESS" : "FAIL")
+                .errorMsg(error == null ? "" : truncate(error.getMessage()))
+                .durationMs(durationMs)
+                .ip(request == null ? "" : WebUtils.getClientIp(request))
+                .build());
+    }
+
+    /** 把方法入参整理成 JSON，文件只记名称和大小。 */
+    private String body(ProceedingJoinPoint point) {
+        Object[] args = point.getArgs();
+        String[] names = ((MethodSignature) point.getSignature()).getParameterNames();
+        Map<String, Object> payload = new LinkedHashMap<>();
+        for (int index = 0; index < args.length; index++) {
+            Object arg = args[index];
+            if (arg == null || arg instanceof ServletRequest || arg instanceof ServletResponse
+                    || arg instanceof BindingResult) {
+                continue;
+            }
+            String name = names != null && index < names.length ? names[index] : "arg" + index;
+            if (arg instanceof MultipartFile file) {
+                payload.put(name, "%s (%d bytes)".formatted(file.getOriginalFilename(), file.getSize()));
+            } else {
+                payload.put(name, arg);
+            }
+        }
+        if (payload.isEmpty()) {
+            return "";
+        }
+        // 只有一个入参时直接序列化该参数，日志更易读
+        return payload.size() == 1 ? json(payload.values().iterator().next()) : json(payload);
+    }
+
+    private String json(Object value) {
+        if (value == null) {
+            return "";
+        }
+        try {
+            String text = objectMapper.writeValueAsString(value);
+            text = SENSITIVE_FIELDS.matcher(text).replaceAll("$1\"***\"");
+            return truncate(text);
+        } catch (Exception ex) {
+            return String.valueOf(value);
+        }
+    }
+
+    private String truncate(String text) {
+        if (text == null) {
+            return "";
+        }
+        return text.length() <= MAX_TEXT ? text : text.substring(0, MAX_TEXT) + TRUNCATED;
+    }
+
+    private HttpServletRequest currentRequest() {
+        if (RequestContextHolder.getRequestAttributes() instanceof ServletRequestAttributes attributes) {
+            return attributes.getRequest();
+        }
+        return null;
+    }
+
+    private LoginUser currentUser() {
+        try {
+            return SecurityUtils.getLoginUser();
+        } catch (Exception ex) {
+            // 登录等公开接口没有登录态
+            return null;
+        }
+    }
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/log/OperationLogEntry.java b/reelshort-framework/src/main/java/com/reelshort/framework/log/OperationLogEntry.java
new file mode 100644
index 0000000..7dfea77
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/log/OperationLogEntry.java
@@ -0,0 +1,25 @@
+package com.reelshort.framework.log;
+
+import lombok.Builder;
+import lombok.Data;
+
+/** 一条待落库的操作记录。 */
+@Data
+@Builder
+public class OperationLogEntry {
+
+    private Long userId;
+    private String username;
+    private String module;
+    private String action;
+    private String requestMethod;
+    private String requestUrl;
+    private String requestParams;
+    private String requestBody;
+    private String responseBody;
+    /** SUCCESS / FAIL */
+    private String status;
+    private String errorMsg;
+    private Integer durationMs;
+    private String ip;
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/log/OperationLogSink.java b/reelshort-framework/src/main/java/com/reelshort/framework/log/OperationLogSink.java
new file mode 100644
index 0000000..ea443c9
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/log/OperationLogSink.java
@@ -0,0 +1,9 @@
+package com.reelshort.framework.log;
+
+/**
+ * 操作日志落库的扩展点，由业务模块实现（框架层不依赖具体存储）。
+ */
+public interface OperationLogSink {
+
+    void save(OperationLogEntry entry);
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/security/JwtAuthenticationFilter.java b/reelshort-framework/src/main/java/com/reelshort/framework/security/JwtAuthenticationFilter.java
new file mode 100644
index 0000000..00b4d9c
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/security/JwtAuthenticationFilter.java
@@ -0,0 +1,51 @@
+package com.reelshort.framework.security;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Component;
+import org.springframework.util.StringUtils;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import java.io.IOException;
+import java.util.List;
+
+/**
+ * 解析 Authorization: Bearer <token>，写入 SecurityContext。
+ */
+@Component
+@RequiredArgsConstructor
+public class JwtAuthenticationFilter extends OncePerRequestFilter {
+
+    private static final String HEADER = "Authorization";
+    private static final String PREFIX = "Bearer ";
+
+    private final JwtTokenProvider tokenProvider;
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
+                                    FilterChain filterChain) throws ServletException, IOException {
+        String header = request.getHeader(HEADER);
+        if (StringUtils.hasText(header) && header.startsWith(PREFIX)) {
+            String token = header.substring(PREFIX.length()).trim();
+            try {
+                LoginUser loginUser = tokenProvider.parseAdminToken(token);
+                List<SimpleGrantedAuthority> authorities = loginUser.permissions() == null
+                        ? List.of()
+                        : loginUser.permissions().stream().map(SimpleGrantedAuthority::new).toList();
+                UsernamePasswordAuthenticationToken authentication =
+                        new UsernamePasswordAuthenticationToken(loginUser, null, authorities);
+                SecurityContextHolder.getContext().setAuthentication(authentication);
+            } catch (Exception ignored) {
+                // token 无效时不抛出，交给后续的鉴权入口统一返回 401
+                SecurityContextHolder.clearContext();
+            }
+        }
+        filterChain.doFilter(request, response);
+    }
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/security/JwtProperties.java b/reelshort-framework/src/main/java/com/reelshort/framework/security/JwtProperties.java
new file mode 100644
index 0000000..a8c707d
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/security/JwtProperties.java
@@ -0,0 +1,17 @@
+package com.reelshort.framework.security;
+
+import lombok.Data;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.stereotype.Component;
+
+@Data
+@Component
+@ConfigurationProperties(prefix = "reelshort.jwt")
+public class JwtProperties {
+
+    /** 管理端签名密钥，长度必须 >= 32 字节。生产环境通过环境变量注入。 */
+    private String adminSecret = "reelshort-admin-dev-secret-change-me-in-production-32b";
+
+    /** 管理端 token 有效期（小时）。 */
+    private int adminTtlHours = 12;
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/security/JwtTokenProvider.java b/reelshort-framework/src/main/java/com/reelshort/framework/security/JwtTokenProvider.java
new file mode 100644
index 0000000..c8977c7
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/security/JwtTokenProvider.java
@@ -0,0 +1,67 @@
+package com.reelshort.framework.security;
+
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.security.Keys;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Component;
+
+import javax.crypto.SecretKey;
+import java.nio.charset.StandardCharsets;
+import java.time.Duration;
+import java.util.Date;
+import java.util.List;
+
+@Component
+@RequiredArgsConstructor
+public class JwtTokenProvider {
+
+    private static final String CLAIM_USER_ID = "userId";
+    private static final String CLAIM_ROLE_CODE = "roleCode";
+    private static final String CLAIM_PERMISSIONS = "permissions";
+
+    private final JwtProperties properties;
+
+    public String createAdminToken(LoginUser loginUser) {
+        Date now = new Date();
+        Date expiration = new Date(now.getTime() + Duration.ofHours(properties.getAdminTtlHours()).toMillis());
+        return Jwts.builder()
+                .subject(loginUser.username())
+                .claim(CLAIM_USER_ID, loginUser.userId())
+                .claim(CLAIM_ROLE_CODE, loginUser.roleCode())
+                .claim(CLAIM_PERMISSIONS, loginUser.permissions())
+                .issuedAt(now)
+                .expiration(expiration)
+                .signWith(adminKey())
+                .compact();
+    }
+
+    @SuppressWarnings("unchecked")
+    public LoginUser parseAdminToken(String token) {
+        try {
+            Claims claims = Jwts.parser()
+                    .verifyWith(adminKey())
+                    .build()
+                    .parseSignedClaims(token)
+                    .getPayload();
+            Number userId = claims.get(CLAIM_USER_ID, Number.class);
+            return new LoginUser(
+                    userId == null ? null : userId.longValue(),
+                    claims.getSubject(),
+                    claims.get(CLAIM_ROLE_CODE, String.class),
+                    (List<String>) claims.get(CLAIM_PERMISSIONS, List.class));
+        } catch (Exception ex) {
+            throw new ServiceException(ErrorCode.UNAUTHORIZED);
+        }
+    }
+
+    private SecretKey adminKey() {
+        byte[] bytes = properties.getAdminSecret().getBytes(StandardCharsets.UTF_8);
+        if (bytes.length < 32) {
+            throw new IllegalStateException("reelshort.jwt.admin-secret 长度必须不少于 32 字节");
+        }
+        return Keys.hmacShaKeyFor(bytes);
+    }
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/security/LoginUser.java b/reelshort-framework/src/main/java/com/reelshort/framework/security/LoginUser.java
new file mode 100644
index 0000000..2a18102
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/security/LoginUser.java
@@ -0,0 +1,13 @@
+package com.reelshort.framework.security;
+
+import java.util.List;
+
+/**
+ * 登录态载体，由 JWT 解析得到，随 SecurityContext 传递。
+ */
+public record LoginUser(Long userId, String username, String roleCode, List<String> permissions) {
+
+    public boolean hasPermission(String permission) {
+        return permissions != null && permissions.contains(permission);
+    }
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/security/PermissionChecker.java b/reelshort-framework/src/main/java/com/reelshort/framework/security/PermissionChecker.java
new file mode 100644
index 0000000..dd4d79c
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/security/PermissionChecker.java
@@ -0,0 +1,50 @@
+package com.reelshort.framework.security;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.stereotype.Component;
+
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * 供 {@code @PreAuthorize("@ss.hasPermission('drama:create')")} 使用的权限判断。
+ * 优先按用户实时查询权限（角色的权限改了立即生效），查不到时退回 JWT 中的权限列表。
+ */
+@Component("ss")
+@RequiredArgsConstructor
+public class PermissionChecker {
+
+    private final ObjectProvider<PermissionProvider> permissionProvider;
+
+    public boolean hasPermission(String permission) {
+        return permissions().contains(permission);
+    }
+
+    public boolean hasAnyPermission(String... permissions) {
+        Set<String> granted = permissions();
+        for (String permission : permissions) {
+            if (granted.contains(permission)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private Set<String> permissions() {
+        LoginUser loginUser = SecurityUtils.getLoginUser();
+        PermissionProvider provider = permissionProvider.getIfAvailable();
+        if (provider != null && loginUser.userId() != null) {
+            try {
+                List<String> codes = provider.listPermissionsByUserId(loginUser.userId());
+                if (codes != null) {
+                    return new HashSet<>(codes);
+                }
+            } catch (Exception ignored) {
+                // 查询失败时退回 JWT 中的权限，避免因为权限服务异常导致全部请求失败
+            }
+        }
+        return loginUser.permissions() == null ? Set.of() : new HashSet<>(loginUser.permissions());
+    }
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/security/PermissionProvider.java b/reelshort-framework/src/main/java/com/reelshort/framework/security/PermissionProvider.java
new file mode 100644
index 0000000..28aa3f0
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/security/PermissionProvider.java
@@ -0,0 +1,12 @@
+package com.reelshort.framework.security;
+
+import java.util.List;
+
+/**
+ * 权限来源的扩展点：由业务模块实现，用于按用户实时查询权限码。
+ * 没有实现时，权限判断退回到 JWT 中携带的权限列表。
+ */
+public interface PermissionProvider {
+
+    List<String> listPermissionsByUserId(Long userId);
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/security/RestAuthEntryPoint.java b/reelshort-framework/src/main/java/com/reelshort/framework/security/RestAuthEntryPoint.java
new file mode 100644
index 0000000..d7af7c4
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/security/RestAuthEntryPoint.java
@@ -0,0 +1,49 @@
+package com.reelshort.framework.security;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.pojo.Result;
+import com.reelshort.framework.log.AccessDeniedRecorder;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.MediaType;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.security.web.access.AccessDeniedHandler;
+import org.springframework.stereotype.Component;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+
+/**
+ * 未登录与无权限时，也返回统一响应体，保证前端拦截器能识别 401 并登出。
+ */
+@Component
+@RequiredArgsConstructor
+public class RestAuthEntryPoint implements AuthenticationEntryPoint, AccessDeniedHandler {
+
+    private final ObjectMapper objectMapper;
+    private final AccessDeniedRecorder accessDeniedRecorder;
+
+    @Override
+    public void commence(HttpServletRequest request, HttpServletResponse response,
+                         AuthenticationException authException) throws IOException {
+        write(response, Result.error(ErrorCode.UNAUTHORIZED));
+    }
+
+    @Override
+    public void handle(HttpServletRequest request, HttpServletResponse response,
+                       AccessDeniedException accessDeniedException) throws IOException {
+        accessDeniedRecorder.record(request);
+        write(response, Result.error(ErrorCode.FORBIDDEN));
+    }
+
+    private void write(HttpServletResponse response, Result<?> result) throws IOException {
+        response.setStatus(HttpServletResponse.SC_OK);
+        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
+        response.setCharacterEncoding(StandardCharsets.UTF_8.name());
+        response.getWriter().write(objectMapper.writeValueAsString(result));
+    }
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/security/SecurityConfig.java b/reelshort-framework/src/main/java/com/reelshort/framework/security/SecurityConfig.java
new file mode 100644
index 0000000..cd32eff
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/security/SecurityConfig.java
@@ -0,0 +1,80 @@
+package com.reelshort.framework.security;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpMethod;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+
+import java.util.Arrays;
+import java.util.List;
+
+@Configuration
+@EnableMethodSecurity
+@RequiredArgsConstructor
+public class SecurityConfig {
+
+    private static final String[] PUBLIC_PATHS = {
+            "/admin/auth/login",
+            /* 客户端接口：浏览与播放暂不要求登录，登录体系（手机号/邮箱）在 C 端鉴权落地后收紧 */
+            "/app/**",
+            /* 本地媒资：图片与视频用 <img>/<video> 直接访问，无法带请求头 */
+            "/files/**",
+            "/doc.html",
+            "/swagger-ui/**",
+            "/swagger-ui.html",
+            "/v3/api-docs/**",
+            "/actuator/health"
+    };
+
+    private final JwtAuthenticationFilter jwtAuthenticationFilter;
+    private final RestAuthEntryPoint restAuthEntryPoint;
+
+    @Value("${reelshort.cors.allowed-origins:http://localhost:3005}")
+    private String allowedOrigins;
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        http.csrf(AbstractHttpConfigurer::disable)
+                .cors(cors -> cors.configurationSource(corsConfigurationSource()))
+                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                .authorizeHttpRequests(registry -> registry
+                        .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
+                        .requestMatchers(PUBLIC_PATHS).permitAll()
+                        .anyRequest().authenticated())
+                .exceptionHandling(handling -> handling
+                        .authenticationEntryPoint(restAuthEntryPoint)
+                        .accessDeniedHandler(restAuthEntryPoint))
+                .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
+        return http.build();
+    }
+
+    @Bean
+    public CorsConfigurationSource corsConfigurationSource() {
+        CorsConfiguration configuration = new CorsConfiguration();
+        configuration.setAllowedOrigins(Arrays.stream(allowedOrigins.split(",")).map(String::trim).toList());
+        configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"));
+        configuration.setAllowedHeaders(List.of("*"));
+        configuration.setAllowCredentials(true);
+        configuration.setMaxAge(3600L);
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/**", configuration);
+        return source;
+    }
+
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/security/SecurityUtils.java b/reelshort-framework/src/main/java/com/reelshort/framework/security/SecurityUtils.java
new file mode 100644
index 0000000..dcd298f
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/security/SecurityUtils.java
@@ -0,0 +1,28 @@
+package com.reelshort.framework.security;
+
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+
+public final class SecurityUtils {
+
+    private SecurityUtils() {
+    }
+
+    public static LoginUser getLoginUser() {
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+        if (authentication != null && authentication.getPrincipal() instanceof LoginUser loginUser) {
+            return loginUser;
+        }
+        throw new ServiceException(ErrorCode.UNAUTHORIZED);
+    }
+
+    public static Long getUserId() {
+        return getLoginUser().userId();
+    }
+
+    public static String getUsername() {
+        return getLoginUser().username();
+    }
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/web/GlobalExceptionHandler.java b/reelshort-framework/src/main/java/com/reelshort/framework/web/GlobalExceptionHandler.java
new file mode 100644
index 0000000..9251344
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/web/GlobalExceptionHandler.java
@@ -0,0 +1,84 @@
+package com.reelshort.framework.web;
+
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import com.reelshort.common.pojo.Result;
+import com.reelshort.framework.log.AccessDeniedRecorder;
+import jakarta.validation.ConstraintViolationException;
+import lombok.extern.slf4j.Slf4j;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.converter.HttpMessageNotReadableException;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.validation.BindException;
+import org.springframework.validation.FieldError;
+import org.springframework.web.bind.MethodArgumentNotValidException;
+import org.springframework.web.bind.MissingServletRequestParameterException;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
+import org.springframework.web.servlet.resource.NoResourceFoundException;
+import org.apache.catalina.connector.ClientAbortException;
+import org.springframework.web.context.request.async.AsyncRequestNotUsableException;
+
+/**
+ * 全局异常处理：所有异常都转成统一响应体，前端拦截器只需判断 code。
+ */
+@Slf4j
+@RestControllerAdvice
+@RequiredArgsConstructor
+public class GlobalExceptionHandler {
+
+    private final AccessDeniedRecorder accessDeniedRecorder;
+
+    @ExceptionHandler(ServiceException.class)
+    public Result<Void> handleServiceException(ServiceException ex) {
+        log.warn("业务异常: code={}, message={}", ex.getCode(), ex.getMessage());
+        return Result.error(ex.getCode(), ex.getMessage());
+    }
+
+    /** 方法级权限校验失败：统一返回 403，前端据此提示无权限。 */
+    @ExceptionHandler(AccessDeniedException.class)
+    public Result<Void> handleAccessDenied(AccessDeniedException ex) {
+        log.warn("无权限访问: {}", ex.getMessage());
+        accessDeniedRecorder.recordCurrentRequest();
+        return Result.error(ErrorCode.FORBIDDEN);
+    }
+
+    @ExceptionHandler({MethodArgumentNotValidException.class, BindException.class})
+    public Result<Void> handleBindException(BindException ex) {
+        FieldError fieldError = ex.getBindingResult().getFieldError();
+        String message = fieldError == null ? ErrorCode.BAD_REQUEST.getMessage() : fieldError.getDefaultMessage();
+        return Result.error(ErrorCode.BAD_REQUEST.getCode(), message);
+    }
+
+    @ExceptionHandler(ConstraintViolationException.class)
+    public Result<Void> handleConstraintViolation(ConstraintViolationException ex) {
+        return Result.error(ErrorCode.BAD_REQUEST.getCode(), ex.getMessage());
+    }
+
+    @ExceptionHandler({MissingServletRequestParameterException.class, HttpMessageNotReadableException.class})
+    public Result<Void> handleBadRequest(Exception ex) {
+        return Result.error(ErrorCode.BAD_REQUEST.getCode(), ErrorCode.BAD_REQUEST.getMessage());
+    }
+
+    /** 静态资源或未匹配的路径：按 404 返回，不要吞成 500。 */
+    @ExceptionHandler(NoResourceFoundException.class)
+    public Result<Void> handleNoResourceFound(NoResourceFoundException ex) {
+        log.warn("资源不存在: {}", ex.getResourcePath());
+        return Result.error(ErrorCode.NOT_FOUND);
+    }
+
+    /**
+     * 客户端中断（例如视频边下边播时用户划走、关闭页面）是正常现象，
+     * 不该记成系统异常，日志降级为 debug。
+     */
+    @ExceptionHandler({ClientAbortException.class, AsyncRequestNotUsableException.class})
+    public void handleClientAbort(Exception ex) {
+        log.debug("客户端中断连接: {}", ex.getMessage());
+    }
+
+    @ExceptionHandler(Exception.class)
+    public Result<Void> handleException(Exception ex) {
+        log.error("系统异常", ex);
+        return Result.error(ErrorCode.INTERNAL_ERROR);
+    }
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/web/SlowRequestLogger.java b/reelshort-framework/src/main/java/com/reelshort/framework/web/SlowRequestLogger.java
new file mode 100644
index 0000000..009727a
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/web/SlowRequestLogger.java
@@ -0,0 +1,40 @@
+package com.reelshort.framework.web;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import java.io.IOException;
+
+/**
+ * 慢请求告警：客户端接口的响应时间目标是 50ms，超过阈值的请求打 WARN，
+ * 方便在内容量增长、索引失效或缓存缺失时第一时间发现。
+ */
+@Slf4j
+@Component
+public class SlowRequestLogger extends OncePerRequestFilter {
+
+    private static final long SLOW_THRESHOLD_MS = 50;
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
+                                    FilterChain filterChain) throws ServletException, IOException {
+        long started = System.currentTimeMillis();
+        try {
+            filterChain.doFilter(request, response);
+        } finally {
+            // 只关注客户端接口，管理端后台页面不做这个约束
+            if (request.getRequestURI().startsWith("/app/")) {
+                long cost = System.currentTimeMillis() - started;
+                if (cost > SLOW_THRESHOLD_MS) {
+                    log.warn("慢请求 {} {} 耗时 {}ms（目标 {}ms）",
+                            request.getMethod(), request.getRequestURI(), cost, SLOW_THRESHOLD_MS);
+                }
+            }
+        }
+    }
+}
diff --git a/reelshort-framework/src/main/java/com/reelshort/framework/web/WebUtils.java b/reelshort-framework/src/main/java/com/reelshort/framework/web/WebUtils.java
new file mode 100644
index 0000000..d1196b6
--- /dev/null
+++ b/reelshort-framework/src/main/java/com/reelshort/framework/web/WebUtils.java
@@ -0,0 +1,25 @@
+package com.reelshort.framework.web;
+
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.util.StringUtils;
+
+public final class WebUtils {
+
+    private static final String UNKNOWN = "unknown";
+
+    private WebUtils() {
+    }
+
+    /** 取真实客户端 IP，兼容 Nginx 反向代理。 */
+    public static String getClientIp(HttpServletRequest request) {
+        String[] headers = {"X-Forwarded-For", "X-Real-IP", "Proxy-Client-IP", "WL-Proxy-Client-IP"};
+        for (String header : headers) {
+            String value = request.getHeader(header);
+            if (StringUtils.hasText(value) && !UNKNOWN.equalsIgnoreCase(value)) {
+                int comma = value.indexOf(',');
+                return comma > 0 ? value.substring(0, comma).trim() : value.trim();
+            }
+        }
+        return request.getRemoteAddr();
+    }
+}
diff --git a/reelshort-module-content/pom.xml b/reelshort-module-content/pom.xml
new file mode 100644
index 0000000..c21f768
--- /dev/null
+++ b/reelshort-module-content/pom.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>com.reelshort</groupId>
+        <artifactId>reelshort</artifactId>
+        <version>1.0.0-SNAPSHOT</version>
+    </parent>
+
+    <artifactId>reelshort-module-content</artifactId>
+    <name>reelshort-module-content</name>
+    <description>内容域：短剧、剧集、审核发布</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>com.reelshort</groupId>
+            <artifactId>reelshort-framework</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.reelshort</groupId>
+            <artifactId>reelshort-module-system</artifactId>
+        </dependency>
+    </dependencies>
+</project>
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/ContentBanner.java b/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/ContentBanner.java
new file mode 100644
index 0000000..cd0464e
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/ContentBanner.java
@@ -0,0 +1,36 @@
+package com.reelshort.content.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.FieldStrategy;
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableLogic;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+@TableName("content_banner")
+public class ContentBanner {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private String imageUrl;
+    /** 展示位置，列名为 slot（position 在 PostgreSQL 里是关键字） */
+    @TableField("slot")
+    private String position;
+    private String linkType;
+    private String linkValue;
+    private Integer sort;
+    private Integer status;
+    private Long createBy;
+    private LocalDateTime createdAt;
+
+    /** updated_at 交给数据库的 ON UPDATE CURRENT_TIMESTAMP 维护 */
+    @TableField(updateStrategy = FieldStrategy.NEVER)
+    private LocalDateTime updatedAt;
+
+    @TableLogic
+    private Integer deleted;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/Drama.java b/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/Drama.java
new file mode 100644
index 0000000..06d9254
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/Drama.java
@@ -0,0 +1,48 @@
+package com.reelshort.content.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.FieldStrategy;
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableLogic;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+@TableName("drama")
+public class Drama {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private String code;
+    private String title;
+    private String subtitle;
+    private Long categoryId;
+    private String genre;
+    private String synopsis;
+    private String coverUrl;
+    private String horizontalCoverUrl;
+    private String language;
+    private Integer totalEpisodes;
+    private Integer freeEpisodes;
+    private Integer unlockCoin;
+    /** 是否热门：1 是，0 否 */
+    private Integer isHot;
+    private String status;
+    private LocalDateTime publishAt;
+    private LocalDateTime publishedAt;
+    private Long viewCount;
+    private Long playCount;
+    private Long favoriteCount;
+    private Long likeCount;
+    private Integer sort;
+    private Long createBy;
+    private LocalDateTime createdAt;
+    /** updated_at 交给数据库的 ON UPDATE CURRENT_TIMESTAMP 维护 */
+    @TableField(updateStrategy = FieldStrategy.NEVER)
+    private LocalDateTime updatedAt;
+    @TableLogic
+    private Integer deleted;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/DramaCategory.java b/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/DramaCategory.java
new file mode 100644
index 0000000..a59a564
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/DramaCategory.java
@@ -0,0 +1,17 @@
+package com.reelshort.content.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+@Data
+@TableName("drama_category")
+public class DramaCategory {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private String name;
+    private Integer sort;
+    private Integer status;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/DramaEpisode.java b/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/DramaEpisode.java
new file mode 100644
index 0000000..da82457
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/DramaEpisode.java
@@ -0,0 +1,38 @@
+package com.reelshort.content.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.FieldStrategy;
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableLogic;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+@TableName("drama_episode")
+public class DramaEpisode {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private Long dramaId;
+    private Integer epNo;
+    private String title;
+    private Integer durationSec;
+    private String coverUrl;
+    private Long videoAssetId;
+    private String videoUrl;
+    private Integer isFree;
+    private Integer unlockCoin;
+    private String status;
+    private LocalDateTime releaseAt;
+    private Long playCount;
+    private Integer sort;
+    private LocalDateTime createdAt;
+    /** updated_at 交给数据库的 ON UPDATE CURRENT_TIMESTAMP 维护 */
+    @TableField(updateStrategy = FieldStrategy.NEVER)
+    private LocalDateTime updatedAt;
+    @TableLogic
+    private Integer deleted;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/DramaReviewRecord.java b/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/DramaReviewRecord.java
new file mode 100644
index 0000000..e6b749c
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/dal/entity/DramaReviewRecord.java
@@ -0,0 +1,23 @@
+package com.reelshort.content.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+@TableName("drama_review_record")
+public class DramaReviewRecord {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private String bizType;
+    private Long bizId;
+    private String action;
+    private String reason;
+    private Long operatorId;
+    private String operatorName;
+    private LocalDateTime createdAt;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/ContentBannerMapper.java b/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/ContentBannerMapper.java
new file mode 100644
index 0000000..e3e2350
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/ContentBannerMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.content.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.content.dal.entity.ContentBanner;
+
+public interface ContentBannerMapper extends BaseMapper<ContentBanner> {
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/DramaCategoryMapper.java b/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/DramaCategoryMapper.java
new file mode 100644
index 0000000..2bea6f3
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/DramaCategoryMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.content.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.content.dal.entity.DramaCategory;
+
+public interface DramaCategoryMapper extends BaseMapper<DramaCategory> {
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/DramaEpisodeMapper.java b/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/DramaEpisodeMapper.java
new file mode 100644
index 0000000..cb33eb0
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/DramaEpisodeMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.content.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.content.dal.entity.DramaEpisode;
+
+public interface DramaEpisodeMapper extends BaseMapper<DramaEpisode> {
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/DramaMapper.java b/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/DramaMapper.java
new file mode 100644
index 0000000..fe3a6da
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/DramaMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.content.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.content.dal.entity.Drama;
+
+public interface DramaMapper extends BaseMapper<Drama> {
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/DramaReviewRecordMapper.java b/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/DramaReviewRecordMapper.java
new file mode 100644
index 0000000..d7e92b8
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/dal/mapper/DramaReviewRecordMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.content.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.content.dal.entity.DramaReviewRecord;
+
+public interface DramaReviewRecordMapper extends BaseMapper<DramaReviewRecord> {
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/enums/BannerLinkType.java b/reelshort-module-content/src/main/java/com/reelshort/content/enums/BannerLinkType.java
new file mode 100644
index 0000000..005cf33
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/enums/BannerLinkType.java
@@ -0,0 +1,36 @@
+package com.reelshort.content.enums;
+
+import lombok.Getter;
+
+/** 轮播图点击后的跳转类型。 */
+@Getter
+public enum BannerLinkType {
+
+    NONE("不跳转"),
+    DRAMA("跳转短剧"),
+    URL("打开链接");
+
+    private final String text;
+
+    BannerLinkType(String text) {
+        this.text = text;
+    }
+
+    public static String textOf(String code) {
+        for (BannerLinkType type : values()) {
+            if (type.name().equals(code)) {
+                return type.text;
+            }
+        }
+        return code;
+    }
+
+    public static boolean isValid(String code) {
+        for (BannerLinkType type : values()) {
+            if (type.name().equals(code)) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/enums/BannerPosition.java b/reelshort-module-content/src/main/java/com/reelshort/content/enums/BannerPosition.java
new file mode 100644
index 0000000..d4dc93b
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/enums/BannerPosition.java
@@ -0,0 +1,35 @@
+package com.reelshort.content.enums;
+
+import lombok.Getter;
+
+/** 轮播图展示位置。 */
+@Getter
+public enum BannerPosition {
+
+    HOME_TOP("首页顶部"),
+    DISCOVER("发现页");
+
+    private final String text;
+
+    BannerPosition(String text) {
+        this.text = text;
+    }
+
+    public static String textOf(String code) {
+        for (BannerPosition position : values()) {
+            if (position.name().equals(code)) {
+                return position.text;
+            }
+        }
+        return code;
+    }
+
+    public static boolean isValid(String code) {
+        for (BannerPosition position : values()) {
+            if (position.name().equals(code)) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/enums/ContentStatus.java b/reelshort-module-content/src/main/java/com/reelshort/content/enums/ContentStatus.java
new file mode 100644
index 0000000..751c7b3
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/enums/ContentStatus.java
@@ -0,0 +1,33 @@
+package com.reelshort.content.enums;
+
+import lombok.Getter;
+
+/**
+ * 短剧与剧集共用一套状态码，与前端展示文案一一对应。
+ */
+@Getter
+public enum ContentStatus {
+
+    DRAFT("draft", "草稿"),
+    REVIEWING("reviewing", "审核中"),
+    APPROVED("approved", "待发布"),
+    PUBLISHED("published", "已上线"),
+    OFFLINE("offline", "已下线");
+
+    private final String code;
+    private final String text;
+
+    ContentStatus(String code, String text) {
+        this.code = code;
+        this.text = text;
+    }
+
+    public static String textOf(String code) {
+        for (ContentStatus status : values()) {
+            if (status.code.equals(code)) {
+                return status.text;
+            }
+        }
+        return code;
+    }
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/service/BannerService.java b/reelshort-module-content/src/main/java/com/reelshort/content/service/BannerService.java
new file mode 100644
index 0000000..157361f
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/service/BannerService.java
@@ -0,0 +1,191 @@
+package com.reelshort.content.service;
+
+import com.baomidou.mybatisplus.core.metadata.IPage;
+import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import com.reelshort.common.pojo.PageResult;
+import com.reelshort.content.dal.entity.ContentBanner;
+import com.reelshort.content.dal.entity.Drama;
+import com.reelshort.content.dal.mapper.ContentBannerMapper;
+import com.reelshort.content.dal.mapper.DramaMapper;
+import com.reelshort.content.enums.BannerLinkType;
+import com.reelshort.content.enums.BannerPosition;
+import com.reelshort.content.vo.BannerRespVO;
+import com.reelshort.content.vo.BannerSaveReqVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.util.StringUtils;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+@Service
+@RequiredArgsConstructor
+public class BannerService {
+
+    private final ContentBannerMapper contentBannerMapper;
+    private final DramaMapper dramaMapper;
+
+    public PageResult<BannerRespVO> page(String position, Integer status, Integer pageIndex, Integer pageSize) {
+        Page<ContentBanner> page = new Page<>(
+                pageIndex == null || pageIndex < 1 ? 1 : pageIndex,
+                pageSize == null || pageSize < 1 ? 10 : pageSize);
+        IPage<ContentBanner> result = contentBannerMapper.selectPage(page,
+                Wrappers.<ContentBanner>lambdaQuery()
+                        .eq(StringUtils.hasText(position), ContentBanner::getPosition, position)
+                        .eq(status != null, ContentBanner::getStatus, status)
+                        .orderByAsc(ContentBanner::getSort)
+                        .orderByDesc(ContentBanner::getId));
+        return new PageResult<>(result.getTotal(), toRespList(result.getRecords()));
+    }
+
+    public BannerRespVO get(Long id) {
+        return toRespList(List.of(getExisting(id))).get(0);
+    }
+
+    /** C 端：启用中的轮播图，按运营排序 */
+    public List<ContentBanner> listActive(String position) {
+        return contentBannerMapper.selectList(Wrappers.<ContentBanner>lambdaQuery()
+                .eq(ContentBanner::getStatus, 1)
+                .eq(StringUtils.hasText(position), ContentBanner::getPosition, position)
+                .orderByAsc(ContentBanner::getSort)
+                .orderByAsc(ContentBanner::getId));
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public Long create(BannerSaveReqVO req, Long operatorId) {
+        ContentBanner banner = new ContentBanner();
+        apply(banner, req);
+        banner.setCreateBy(operatorId == null ? 0L : operatorId);
+        contentBannerMapper.insert(banner);
+        return banner.getId();
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public void update(Long id, BannerSaveReqVO req) {
+        ContentBanner banner = getExisting(id);
+        apply(banner, req);
+        contentBannerMapper.updateById(banner);
+    }
+
+    public void delete(Long id) {
+        getExisting(id);
+        contentBannerMapper.deleteById(id);
+    }
+
+    public void updateStatus(Long id, Integer status) {
+        ContentBanner banner = getExisting(id);
+        banner.setStatus(status == null || status == 0 ? 0 : 1);
+        contentBannerMapper.updateById(banner);
+    }
+
+    /** 按传入顺序重排 sort */
+    @Transactional(rollbackFor = Exception.class)
+    public void updateSort(List<Long> ids) {
+        for (int index = 0; index < ids.size(); index++) {
+            ContentBanner banner = contentBannerMapper.selectById(ids.get(index));
+            if (banner != null) {
+                banner.setSort(index + 1);
+                contentBannerMapper.updateById(banner);
+            }
+        }
+    }
+
+    private ContentBanner getExisting(Long id) {
+        ContentBanner banner = id == null ? null : contentBannerMapper.selectById(id);
+        if (banner == null) {
+            throw new ServiceException(ErrorCode.DATA_NOT_FOUND, "轮播图不存在");
+        }
+        return banner;
+    }
+
+    private void apply(ContentBanner banner, BannerSaveReqVO req) {
+        String position = StringUtils.hasText(req.getPosition()) ? req.getPosition() : BannerPosition.HOME_TOP.name();
+        if (!BannerPosition.isValid(position)) {
+            throw new ServiceException(ErrorCode.BAD_REQUEST, "未知的展示位置: " + position);
+        }
+        String linkType = StringUtils.hasText(req.getLinkType()) ? req.getLinkType() : BannerLinkType.NONE.name();
+        if (!BannerLinkType.isValid(linkType)) {
+            throw new ServiceException(ErrorCode.BAD_REQUEST, "未知的跳转类型: " + linkType);
+        }
+        String linkValue = req.getLinkValue() == null ? "" : req.getLinkValue().trim();
+        if (BannerLinkType.DRAMA.name().equals(linkType)) {
+            if (!StringUtils.hasText(linkValue)) {
+                throw new ServiceException(ErrorCode.BAD_REQUEST, "请选择要跳转的短剧");
+            }
+            // link_value 存的是字符串，查询前必须转成 Long，
+            // 否则 PostgreSQL 会直接拒绝 varchar 与 bigint 比较。
+            Long dramaId = parseId(linkValue);
+            if (dramaId == null || dramaMapper.selectById(dramaId) == null) {
+                throw new ServiceException(ErrorCode.BAD_REQUEST, "跳转的短剧不存在");
+            }
+            linkValue = String.valueOf(dramaId);
+        } else if (BannerLinkType.URL.name().equals(linkType)) {
+            if (!StringUtils.hasText(linkValue)) {
+                throw new ServiceException(ErrorCode.BAD_REQUEST, "请填写跳转地址");
+            }
+        } else {
+            linkValue = "";
+        }
+        banner.setImageUrl(req.getImageUrl().trim());
+        banner.setPosition(position);
+        banner.setLinkType(linkType);
+        banner.setLinkValue(linkValue);
+        banner.setSort(req.getSort() == null ? 0 : req.getSort());
+        banner.setStatus(req.getStatus() == null ? 1 : req.getStatus());
+    }
+
+    private List<BannerRespVO> toRespList(List<ContentBanner> banners) {
+        if (banners.isEmpty()) {
+            return List.of();
+        }
+        // 批量取跳转短剧名称
+        List<Long> dramaIds = banners.stream()
+                .filter(banner -> BannerLinkType.DRAMA.name().equals(banner.getLinkType()))
+                .map(banner -> parseId(banner.getLinkValue()))
+                .filter(id -> id != null)
+                .distinct()
+                .toList();
+        Map<Long, String> dramaNames = new HashMap<>();
+        if (!dramaIds.isEmpty()) {
+            dramaMapper.selectList(Wrappers.<Drama>lambdaQuery().in(Drama::getId, dramaIds))
+                    .forEach(drama -> dramaNames.put(drama.getId(), drama.getTitle()));
+        }
+
+        return banners.stream().map(banner -> {
+            BannerRespVO vo = new BannerRespVO();
+            vo.setId(banner.getId());
+            vo.setImageUrl(banner.getImageUrl());
+            vo.setPosition(banner.getPosition());
+            vo.setPositionText(BannerPosition.textOf(banner.getPosition()));
+            vo.setLinkType(banner.getLinkType());
+            vo.setLinkTypeText(BannerLinkType.textOf(banner.getLinkType()));
+            vo.setLinkValue(banner.getLinkValue());
+            if (BannerLinkType.DRAMA.name().equals(banner.getLinkType())) {
+                Long dramaId = parseId(banner.getLinkValue());
+                vo.setLinkText(dramaId == null ? "" : dramaNames.getOrDefault(dramaId, "已删除的短剧"));
+            } else if (BannerLinkType.URL.name().equals(banner.getLinkType())) {
+                vo.setLinkText(banner.getLinkValue());
+            } else {
+                vo.setLinkText("");
+            }
+            vo.setSort(banner.getSort());
+            vo.setStatus(banner.getStatus());
+            vo.setStatusText(banner.getStatus() != null && banner.getStatus() == 1 ? "启用" : "停用");
+            vo.setUpdatedAt(banner.getUpdatedAt());
+            return vo;
+        }).toList();
+    }
+
+    private Long parseId(String value) {
+        try {
+            return Long.valueOf(value);
+        } catch (NumberFormatException ex) {
+            return null;
+        }
+    }
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/service/DramaCategoryService.java b/reelshort-module-content/src/main/java/com/reelshort/content/service/DramaCategoryService.java
new file mode 100644
index 0000000..28f77c5
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/service/DramaCategoryService.java
@@ -0,0 +1,127 @@
+package com.reelshort.content.service;
+
+import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import com.reelshort.content.dal.entity.Drama;
+import com.reelshort.content.dal.entity.DramaCategory;
+import com.reelshort.content.dal.mapper.DramaMapper;
+import com.reelshort.content.dal.mapper.DramaCategoryMapper;
+import com.reelshort.content.vo.DramaCategoryRespVO;
+import com.reelshort.content.vo.DramaCategorySaveReqVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+@Service
+@RequiredArgsConstructor
+public class DramaCategoryService {
+
+    private final DramaCategoryMapper dramaCategoryMapper;
+    private final DramaMapper dramaMapper;
+
+    public List<DramaCategoryRespVO> list() {
+        Map<Long, Integer> counts = countDramasByCategory();
+        return dramaCategoryMapper.selectList(
+                        Wrappers.<DramaCategory>lambdaQuery().orderByAsc(DramaCategory::getSort))
+                .stream().map(category -> {
+                    DramaCategoryRespVO vo = new DramaCategoryRespVO();
+                    vo.setId(category.getId());
+                    vo.setName(category.getName());
+                    vo.setSort(category.getSort());
+                    vo.setStatus(category.getStatus());
+                    vo.setDramaCount(counts.getOrDefault(category.getId(), 0));
+                    return vo;
+                }).toList();
+    }
+
+    public Long create(DramaCategorySaveReqVO req) {
+        ensureNameAvailable(req.getName(), null);
+        DramaCategory category = new DramaCategory();
+        category.setName(req.getName().trim());
+        Long count = dramaCategoryMapper.selectCount(null);
+        category.setSort(req.getSort() == null
+                ? (count == null ? 0 : count.intValue()) + 1
+                : req.getSort());
+        category.setStatus(req.getStatus() == null ? 1 : req.getStatus());
+        dramaCategoryMapper.insert(category);
+        return category.getId();
+    }
+
+    /**
+     * 轻量列表：只查分类本身，不统计短剧数量。
+     * C 端展示和名称映射用它，避免为了一个名称把整张短剧表扫一遍。
+     */
+    public List<DramaCategoryRespVO> listBasic() {
+        return dramaCategoryMapper.selectList(
+                        Wrappers.<DramaCategory>lambdaQuery().orderByAsc(DramaCategory::getSort))
+                .stream().map(category -> {
+                    DramaCategoryRespVO vo = new DramaCategoryRespVO();
+                    vo.setId(category.getId());
+                    vo.setName(category.getName());
+                    vo.setSort(category.getSort());
+                    vo.setStatus(category.getStatus());
+                    return vo;
+                }).toList();
+    }
+
+    public void update(Long id, DramaCategorySaveReqVO req) {
+        DramaCategory category = getExisting(id);
+        ensureNameAvailable(req.getName(), id);
+        category.setName(req.getName().trim());
+        if (req.getSort() != null) {
+            category.setSort(req.getSort());
+        }
+        if (req.getStatus() != null) {
+            category.setStatus(req.getStatus());
+        }
+        dramaCategoryMapper.updateById(category);
+    }
+
+    public void delete(Long id) {
+        DramaCategory category = getExisting(id);
+        Integer used = countDramasByCategory().getOrDefault(id, 0);
+        if (used > 0) {
+            throw new ServiceException(ErrorCode.OPERATION_NOT_ALLOWED,
+                    "「" + category.getName() + "」下还有 " + used + " 部短剧，无法删除");
+        }
+        dramaCategoryMapper.deleteById(id);
+    }
+
+    private DramaCategory getExisting(Long id) {
+        DramaCategory category = id == null ? null : dramaCategoryMapper.selectById(id);
+        if (category == null) {
+            throw new ServiceException(ErrorCode.DATA_NOT_FOUND, "类型不存在");
+        }
+        return category;
+    }
+
+    private void ensureNameAvailable(String name, Long excludeId) {
+        Long count = dramaCategoryMapper.selectCount(Wrappers.<DramaCategory>lambdaQuery()
+                .eq(DramaCategory::getName, name.trim())
+                .ne(excludeId != null, DramaCategory::getId, excludeId));
+        if (count != null && count > 0) {
+            throw new ServiceException(ErrorCode.DATA_EXISTS, "类型名称已存在");
+        }
+    }
+
+    private Map<Long, Integer> countDramasByCategory() {
+        Map<Long, Integer> counts = new HashMap<>();
+        dramaMapper.selectList(Wrappers.<Drama>lambdaQuery().select(Drama::getCategoryId))
+                .forEach(drama -> {
+                    if (drama.getCategoryId() != null && drama.getCategoryId() > 0) {
+                        counts.merge(drama.getCategoryId(), 1, Integer::sum);
+                    }
+                });
+        return counts;
+    }
+
+    public Map<Long, String> nameMap() {
+        return dramaCategoryMapper.selectList(null).stream()
+                .collect(Collectors.toMap(DramaCategory::getId, DramaCategory::getName, (a, b) -> a));
+    }
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/service/DramaService.java b/reelshort-module-content/src/main/java/com/reelshort/content/service/DramaService.java
new file mode 100644
index 0000000..101093e
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/service/DramaService.java
@@ -0,0 +1,263 @@
+package com.reelshort.content.service;
+
+import com.baomidou.mybatisplus.core.metadata.IPage;
+import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import com.reelshort.common.pojo.PageResult;
+import com.reelshort.content.dal.entity.Drama;
+import com.reelshort.content.dal.entity.DramaEpisode;
+import com.reelshort.content.dal.entity.DramaReviewRecord;
+import com.reelshort.content.dal.mapper.DramaEpisodeMapper;
+import com.reelshort.content.dal.mapper.DramaMapper;
+import com.reelshort.content.dal.mapper.DramaReviewRecordMapper;
+import com.reelshort.content.enums.ContentStatus;
+import com.reelshort.content.vo.DramaPageReqVO;
+import com.reelshort.content.vo.DramaRespVO;
+import com.reelshort.content.vo.DramaSaveReqVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.util.StringUtils;
+
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+import java.time.format.DateTimeFormatter;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+@Service
+@RequiredArgsConstructor
+public class DramaService {
+
+    private static final DateTimeFormatter CODE_DATE = DateTimeFormatter.ofPattern("yyyyMMdd");
+
+    private final DramaMapper dramaMapper;
+    private final DramaEpisodeMapper dramaEpisodeMapper;
+    private final DramaReviewRecordMapper dramaReviewRecordMapper;
+    private final DramaCategoryService dramaCategoryService;
+
+    public PageResult<DramaRespVO> page(DramaPageReqVO req) {
+        Page<Drama> page = new Page<>(req.getSafePageIndex(), req.getSafePageSize());
+        IPage<Drama> result = dramaMapper.selectPage(page, Wrappers.<Drama>lambdaQuery()
+                .like(StringUtils.hasText(req.getKeyword()), Drama::getTitle, req.getKeyword())
+                .eq(StringUtils.hasText(req.getStatus()), Drama::getStatus, req.getStatus())
+                .eq(req.getCategoryId() != null, Drama::getCategoryId, req.getCategoryId())
+                .eq(req.getIsHot() != null, Drama::getIsHot, Boolean.TRUE.equals(req.getIsHot()) ? 1 : 0)
+                .orderByDesc(Drama::getSort)
+                .orderByDesc(Drama::getId));
+        return new PageResult<>(result.getTotal(), toRespList(result.getRecords()));
+    }
+
+    public DramaRespVO get(Long id) {
+        return toRespList(List.of(getExisting(id))).get(0);
+    }
+
+    public Drama getExisting(Long id) {
+        Drama drama = id == null ? null : dramaMapper.selectById(id);
+        if (drama == null) {
+            throw new ServiceException(ErrorCode.DATA_NOT_FOUND, "短剧不存在");
+        }
+        return drama;
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public Long create(DramaSaveReqVO req, Long operatorId) {
+        Drama drama = new Drama();
+        apply(drama, req);
+        drama.setCode(generateCode());
+        drama.setStatus(ContentStatus.DRAFT.getCode());
+        drama.setTotalEpisodes(0);
+        drama.setViewCount(0L);
+        drama.setPlayCount(0L);
+        drama.setFavoriteCount(0L);
+        drama.setLikeCount(0L);
+        drama.setCreateBy(operatorId == null ? 0L : operatorId);
+        dramaMapper.insert(drama);
+        return drama.getId();
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public void update(Long id, DramaSaveReqVO req) {
+        Drama drama = getExisting(id);
+        apply(drama, req);
+        dramaMapper.updateById(drama);
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public void delete(Long id) {
+        Drama drama = getExisting(id);
+        if (ContentStatus.PUBLISHED.getCode().equals(drama.getStatus())) {
+            throw new ServiceException(ErrorCode.OPERATION_NOT_ALLOWED, "已上线的短剧需先下线再删除");
+        }
+        dramaMapper.deleteById(id);
+        dramaEpisodeMapper.delete(Wrappers.<DramaEpisode>lambdaQuery().eq(DramaEpisode::getDramaId, id));
+    }
+
+    /** 审核与发布的状态流转。 */
+    @Transactional(rollbackFor = Exception.class)
+    public void changeStatus(Long id, String action, String reason, Long operatorId, String operatorName) {
+        Drama drama = getExisting(id);
+        String current = drama.getStatus();
+        String target = switch (action) {
+            case "SUBMIT" -> {
+                requireState(current, "SUBMIT", Set.of(ContentStatus.DRAFT.getCode(), ContentStatus.OFFLINE.getCode()));
+                yield ContentStatus.REVIEWING.getCode();
+            }
+            case "APPROVE" -> {
+                requireState(current, "APPROVE", Set.of(ContentStatus.REVIEWING.getCode()));
+                yield ContentStatus.APPROVED.getCode();
+            }
+            case "REJECT" -> {
+                requireState(current, "REJECT", Set.of(ContentStatus.REVIEWING.getCode()));
+                yield ContentStatus.DRAFT.getCode();
+            }
+            case "PUBLISH" -> {
+                requireState(current, "PUBLISH", Set.of(ContentStatus.APPROVED.getCode(),
+                        ContentStatus.OFFLINE.getCode()));
+                yield ContentStatus.PUBLISHED.getCode();
+            }
+            case "OFFLINE" -> {
+                requireState(current, "OFFLINE", Set.of(ContentStatus.PUBLISHED.getCode()));
+                yield ContentStatus.OFFLINE.getCode();
+            }
+            default -> throw new ServiceException(ErrorCode.BAD_REQUEST, "未知的审核动作: " + action);
+        };
+
+        drama.setStatus(target);
+        if (ContentStatus.PUBLISHED.getCode().equals(target)) {
+            drama.setPublishedAt(LocalDateTime.now());
+        }
+        dramaMapper.updateById(drama);
+
+        DramaReviewRecord record = new DramaReviewRecord();
+        record.setBizType("DRAMA");
+        record.setBizId(id);
+        record.setAction(action);
+        record.setReason(reason == null ? "" : reason);
+        record.setOperatorId(operatorId == null ? 0L : operatorId);
+        record.setOperatorName(operatorName == null ? "" : operatorName);
+        dramaReviewRecordMapper.insert(record);
+
+    }
+
+    public List<DramaReviewRecord> listReviewRecords(Long dramaId) {
+        return dramaReviewRecordMapper.selectList(Wrappers.<DramaReviewRecord>lambdaQuery()
+                .eq(DramaReviewRecord::getBizType, "DRAMA")
+                .eq(DramaReviewRecord::getBizId, dramaId)
+                .orderByDesc(DramaReviewRecord::getCreatedAt));
+    }
+
+    // ========== C 端只读视图：只暴露已上线内容 ==========
+
+    /** 已上线短剧，按运营排序 + 播放量 */
+    public List<Drama> listPublished(Long categoryId, long limit) {
+        Page<Drama> page = new Page<>(1, Math.max(1, limit));
+        return dramaMapper.selectPage(page, Wrappers.<Drama>lambdaQuery()
+                .eq(Drama::getStatus, ContentStatus.PUBLISHED.getCode())
+                .eq(categoryId != null && categoryId > 0, Drama::getCategoryId, categoryId)
+                .orderByDesc(Drama::getSort)
+                .orderByDesc(Drama::getViewCount)).getRecords();
+    }
+
+    /** 已上线短剧，按上线时间倒序 */
+    public List<Drama> listPublishedLatest(long limit) {
+        Page<Drama> page = new Page<>(1, Math.max(1, limit));
+        return dramaMapper.selectPage(page, Wrappers.<Drama>lambdaQuery()
+                .eq(Drama::getStatus, ContentStatus.PUBLISHED.getCode())
+                .orderByDesc(Drama::getPublishedAt)
+                .orderByDesc(Drama::getId)).getRecords();
+    }
+
+    /** 已上线的热门短剧 */
+    public List<Drama> listPublishedHot(long limit) {
+        Page<Drama> page = new Page<>(1, Math.max(1, limit));
+        return dramaMapper.selectPage(page, Wrappers.<Drama>lambdaQuery()
+                .eq(Drama::getStatus, ContentStatus.PUBLISHED.getCode())
+                .eq(Drama::getIsHot, 1)
+                .orderByDesc(Drama::getSort)
+                .orderByDesc(Drama::getViewCount)).getRecords();
+    }
+
+    /** 已上线的短剧，未上线/已下线一律按不存在处理 */
+    public Drama getPublished(Long id) {
+        Drama drama = getExisting(id);
+        if (!ContentStatus.PUBLISHED.getCode().equals(drama.getStatus())) {
+            throw new ServiceException(ErrorCode.DATA_NOT_FOUND, "短剧不存在或已下线");
+        }
+        return drama;
+    }
+
+    /** 剧集数量变化后同步冗余字段。 */
+    public void syncTotalEpisodes(Long dramaId) {
+        Long count = dramaEpisodeMapper.selectCount(
+                Wrappers.<DramaEpisode>lambdaQuery().eq(DramaEpisode::getDramaId, dramaId));
+        Drama drama = dramaMapper.selectById(dramaId);
+        if (drama != null) {
+            drama.setTotalEpisodes(count == null ? 0 : count.intValue());
+            dramaMapper.updateById(drama);
+        }
+    }
+
+    private void requireState(String current, String action, Set<String> allowed) {
+        if (!allowed.contains(current)) {
+            throw new ServiceException(ErrorCode.OPERATION_NOT_ALLOWED,
+                    "当前状态(" + ContentStatus.textOf(current) + ")不允许执行该操作");
+        }
+    }
+
+    private void apply(Drama drama, DramaSaveReqVO req) {
+        drama.setTitle(req.getTitle());
+        drama.setSubtitle(req.getSubtitle() == null ? "" : req.getSubtitle());
+        drama.setCategoryId(req.getCategoryId() == null ? 0L : req.getCategoryId());
+        drama.setGenre(req.getGenre() == null ? "" : req.getGenre());
+        drama.setSynopsis(req.getDescription() == null ? "" : req.getDescription());
+        drama.setCoverUrl(req.getCover() == null ? "" : req.getCover());
+        drama.setHorizontalCoverUrl(drama.getHorizontalCoverUrl() == null ? "" : drama.getHorizontalCoverUrl());
+        drama.setLanguage(req.getLanguage() == null ? "zh-CN" : req.getLanguage());
+        drama.setFreeEpisodes(req.getFreeEpisodes() == null ? 3 : req.getFreeEpisodes());
+        drama.setUnlockCoin(req.getUnlockCoin() == null ? 0 : req.getUnlockCoin());
+        drama.setIsHot(Boolean.TRUE.equals(req.getIsHot()) ? 1 : 0);
+        drama.setSort(req.getSort() == null ? 0 : req.getSort());
+    }
+
+    private String generateCode() {
+        Long count = dramaMapper.selectCount(null);
+        return "D" + LocalDate.now().format(CODE_DATE)
+                + String.format("%03d", (count == null ? 0 : count + 1));
+    }
+
+    private List<DramaRespVO> toRespList(List<Drama> dramas) {
+        if (dramas.isEmpty()) {
+            return List.of();
+        }
+        Map<Long, String> categories = dramaCategoryService.nameMap();
+        return dramas.stream().map(drama -> {
+            DramaRespVO vo = new DramaRespVO();
+            vo.setId(drama.getId());
+            vo.setCode(drama.getCode());
+            vo.setTitle(drama.getTitle());
+            vo.setSubtitle(drama.getSubtitle());
+            vo.setCategoryId(drama.getCategoryId());
+            vo.setCategory(categories.getOrDefault(drama.getCategoryId(), ""));
+            vo.setGenre(drama.getGenre());
+            vo.setDescription(drama.getSynopsis());
+            vo.setCover(drama.getCoverUrl());
+            vo.setLanguage(drama.getLanguage());
+            vo.setEpisodes(drama.getTotalEpisodes());
+            vo.setFreeEpisodes(drama.getFreeEpisodes());
+            vo.setUnlockCoin(drama.getUnlockCoin());
+            vo.setIsHot(drama.getIsHot() != null && drama.getIsHot() == 1);
+            vo.setStatus(drama.getStatus());
+            vo.setStatusText(ContentStatus.textOf(drama.getStatus()));
+            vo.setViews(drama.getViewCount());
+            vo.setSort(drama.getSort());
+            vo.setPublishAt(drama.getPublishedAt());
+            vo.setCreatedAt(drama.getCreatedAt());
+            vo.setUpdatedAt(drama.getUpdatedAt());
+            return vo;
+        }).toList();
+    }
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/service/EpisodeService.java b/reelshort-module-content/src/main/java/com/reelshort/content/service/EpisodeService.java
new file mode 100644
index 0000000..5ed0b99
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/service/EpisodeService.java
@@ -0,0 +1,180 @@
+package com.reelshort.content.service;
+
+import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import com.reelshort.content.dal.entity.DramaEpisode;
+import com.reelshort.content.dal.mapper.DramaEpisodeMapper;
+import com.reelshort.content.enums.ContentStatus;
+import com.reelshort.content.vo.EpisodeRespVO;
+import com.reelshort.content.vo.EpisodeSaveReqVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+@Service
+@RequiredArgsConstructor
+public class EpisodeService {
+
+    private final DramaEpisodeMapper dramaEpisodeMapper;
+    private final DramaService dramaService;
+
+    public List<EpisodeRespVO> listByDrama(Long dramaId, String status) {
+        dramaService.getExisting(dramaId);
+        return dramaEpisodeMapper.selectList(Wrappers.<DramaEpisode>lambdaQuery()
+                        .eq(DramaEpisode::getDramaId, dramaId)
+                        .eq(status != null && !status.isBlank(), DramaEpisode::getStatus, status)
+                        .orderByAsc(DramaEpisode::getSort)
+                        .orderByAsc(DramaEpisode::getEpNo))
+                .stream().map(this::toResp).toList();
+    }
+
+    /** C 端：只返回已上线剧集，按播放顺序 */
+    public List<DramaEpisode> listPublishedByDrama(Long dramaId) {
+        return dramaEpisodeMapper.selectList(Wrappers.<DramaEpisode>lambdaQuery()
+                .eq(DramaEpisode::getDramaId, dramaId)
+                .eq(DramaEpisode::getStatus, ContentStatus.PUBLISHED.getCode())
+                .orderByAsc(DramaEpisode::getSort)
+                .orderByAsc(DramaEpisode::getEpNo));
+    }
+
+    /**
+     * C 端：批量取每部剧的首个可播免费集，用于列表卡片直接起播。
+     * 整屏卡片共用一次 IN 查询，避免逐条查库。
+     */
+    public Map<Long, DramaEpisode> firstPlayableByDramas(List<Long> dramaIds) {
+        if (dramaIds == null || dramaIds.isEmpty()) {
+            return Map.of();
+        }
+        List<DramaEpisode> episodes = dramaEpisodeMapper.selectList(
+                Wrappers.<DramaEpisode>lambdaQuery()
+                        .in(DramaEpisode::getDramaId, dramaIds)
+                        .eq(DramaEpisode::getStatus, ContentStatus.PUBLISHED.getCode())
+                        .eq(DramaEpisode::getIsFree, 1)
+                        .isNotNull(DramaEpisode::getVideoUrl)
+                        .ne(DramaEpisode::getVideoUrl, "")
+                        .orderByAsc(DramaEpisode::getDramaId)
+                        .orderByAsc(DramaEpisode::getSort)
+                        .orderByAsc(DramaEpisode::getEpNo));
+        Map<Long, DramaEpisode> firstPlayable = new LinkedHashMap<>();
+        for (DramaEpisode episode : episodes) {
+            firstPlayable.putIfAbsent(episode.getDramaId(), episode);
+        }
+        return firstPlayable;
+    }
+
+    /** C 端：已上线剧集，否则按不存在处理 */
+    public DramaEpisode getPublished(Long id) {
+        DramaEpisode episode = getExisting(id);
+        if (!ContentStatus.PUBLISHED.getCode().equals(episode.getStatus())) {
+            throw new ServiceException(ErrorCode.DATA_NOT_FOUND, "剧集不存在或未上线");
+        }
+        return episode;
+    }
+
+    public DramaEpisode getExisting(Long id) {
+        DramaEpisode episode = id == null ? null : dramaEpisodeMapper.selectById(id);
+        if (episode == null) {
+            throw new ServiceException(ErrorCode.DATA_NOT_FOUND, "剧集不存在");
+        }
+        return episode;
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public Long create(EpisodeSaveReqVO req) {
+        dramaService.getExisting(req.getDramaId());
+        ensureEpNoAvailable(req.getDramaId(), req.getNumber(), null);
+        DramaEpisode episode = new DramaEpisode();
+        apply(episode, req);
+        episode.setStatus(req.getStatus() == null ? ContentStatus.DRAFT.getCode() : req.getStatus());
+        episode.setPlayCount(0L);
+        episode.setVideoAssetId(0L);
+        dramaEpisodeMapper.insert(episode);
+        dramaService.syncTotalEpisodes(req.getDramaId());
+        return episode.getId();
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public void update(Long id, EpisodeSaveReqVO req) {
+        DramaEpisode episode = getExisting(id);
+        dramaService.getExisting(req.getDramaId());
+        ensureEpNoAvailable(req.getDramaId(), req.getNumber(), id);
+        apply(episode, req);
+        if (req.getStatus() != null) {
+            episode.setStatus(req.getStatus());
+        }
+        dramaEpisodeMapper.updateById(episode);
+        if (!req.getDramaId().equals(episode.getDramaId())) {
+            dramaService.syncTotalEpisodes(req.getDramaId());
+        }
+        dramaService.syncTotalEpisodes(episode.getDramaId());
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public void delete(Long id) {
+        DramaEpisode episode = getExisting(id);
+        dramaEpisodeMapper.deleteById(id);
+        dramaService.syncTotalEpisodes(episode.getDramaId());
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public void updateSort(List<Long> ids) {
+        for (int index = 0; index < ids.size(); index++) {
+            DramaEpisode episode = dramaEpisodeMapper.selectById(ids.get(index));
+            if (episode != null) {
+                episode.setSort(index + 1);
+                dramaEpisodeMapper.updateById(episode);
+            }
+        }
+    }
+
+    private void ensureEpNoAvailable(Long dramaId, Integer epNo, Long excludeId) {
+        Long count = dramaEpisodeMapper.selectCount(Wrappers.<DramaEpisode>lambdaQuery()
+                .eq(DramaEpisode::getDramaId, dramaId)
+                .eq(DramaEpisode::getEpNo, epNo)
+                .ne(excludeId != null, DramaEpisode::getId, excludeId));
+        if (count != null && count > 0) {
+            throw new ServiceException(ErrorCode.DATA_EXISTS, "第 " + epNo + " 集已存在");
+        }
+    }
+
+    private void apply(DramaEpisode episode, EpisodeSaveReqVO req) {
+        episode.setDramaId(req.getDramaId());
+        episode.setEpNo(req.getNumber());
+        episode.setTitle(req.getTitle() == null ? "" : req.getTitle());
+        episode.setDurationSec(req.getDurationSec() == null ? 0 : req.getDurationSec());
+        episode.setCoverUrl(req.getCover() == null ? "" : req.getCover());
+        episode.setVideoUrl(req.getVideoUrl() == null ? "" : req.getVideoUrl());
+        episode.setIsFree(Boolean.TRUE.equals(req.getIsFree()) ? 1 : 0);
+        episode.setUnlockCoin(req.getUnlockCoin() == null ? 0 : req.getUnlockCoin());
+        episode.setSort(req.getSort() == null ? (req.getNumber() == null ? 0 : req.getNumber()) : req.getSort());
+    }
+
+    private EpisodeRespVO toResp(DramaEpisode episode) {
+        EpisodeRespVO vo = new EpisodeRespVO();
+        vo.setId(episode.getId());
+        vo.setDramaId(episode.getDramaId());
+        vo.setNumber(episode.getEpNo());
+        vo.setTitle(episode.getTitle());
+        vo.setDurationSec(episode.getDurationSec());
+        vo.setDuration(formatDuration(episode.getDurationSec()));
+        vo.setCover(episode.getCoverUrl());
+        vo.setVideoUrl(episode.getVideoUrl());
+        vo.setIsFree(episode.getIsFree() != null && episode.getIsFree() == 1);
+        vo.setUnlockCoin(episode.getUnlockCoin());
+        vo.setStatus(episode.getStatus());
+        vo.setStatusText(ContentStatus.textOf(episode.getStatus()));
+        vo.setViews(episode.getPlayCount());
+        vo.setSort(episode.getSort());
+        return vo;
+    }
+
+    private String formatDuration(Integer seconds) {
+        int value = seconds == null ? 0 : seconds;
+        return String.format("%02d:%02d", value / 60, value % 60);
+    }
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/vo/BannerRespVO.java b/reelshort-module-content/src/main/java/com/reelshort/content/vo/BannerRespVO.java
new file mode 100644
index 0000000..14db061
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/vo/BannerRespVO.java
@@ -0,0 +1,26 @@
+package com.reelshort.content.vo;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+public class BannerRespVO {
+
+    private Long id;
+    private String imageUrl;
+    private String position;
+    private String positionText;
+    private String linkType;
+    private String linkTypeText;
+    private String linkValue;
+    /** 跳转目标的展示文案，如短剧名称 */
+    private String linkText;
+    private Integer sort;
+    private Integer status;
+    private String statusText;
+
+    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    private LocalDateTime updatedAt;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/vo/BannerSaveReqVO.java b/reelshort-module-content/src/main/java/com/reelshort/content/vo/BannerSaveReqVO.java
new file mode 100644
index 0000000..fd2bfff
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/vo/BannerSaveReqVO.java
@@ -0,0 +1,22 @@
+package com.reelshort.content.vo;
+
+import lombok.Data;
+
+@Data
+public class BannerSaveReqVO {
+
+    @jakarta.validation.constraints.NotBlank(message = "请上传轮播图片")
+    private String imageUrl;
+
+    /** HOME_TOP / DISCOVER */
+    private String position;
+
+    /** NONE / DRAMA / URL */
+    private String linkType;
+
+    /** 剧集 ID 或跳转地址 */
+    private String linkValue;
+
+    private Integer sort;
+    private Integer status;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaCategoryRespVO.java b/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaCategoryRespVO.java
new file mode 100644
index 0000000..cd3ff37
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaCategoryRespVO.java
@@ -0,0 +1,14 @@
+package com.reelshort.content.vo;
+
+import lombok.Data;
+
+@Data
+public class DramaCategoryRespVO {
+
+    private Long id;
+    private String name;
+    private Integer sort;
+    private Integer status;
+    /** 该类型下的短剧数量 */
+    private Integer dramaCount;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaCategorySaveReqVO.java b/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaCategorySaveReqVO.java
new file mode 100644
index 0000000..837acd1
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaCategorySaveReqVO.java
@@ -0,0 +1,14 @@
+package com.reelshort.content.vo;
+
+import jakarta.validation.constraints.NotBlank;
+import lombok.Data;
+
+@Data
+public class DramaCategorySaveReqVO {
+
+    @NotBlank(message = "请填写类型名称")
+    private String name;
+
+    private Integer sort;
+    private Integer status;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaPageReqVO.java b/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaPageReqVO.java
new file mode 100644
index 0000000..3521639
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaPageReqVO.java
@@ -0,0 +1,17 @@
+package com.reelshort.content.vo;
+
+import com.reelshort.common.pojo.PageParam;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class DramaPageReqVO extends PageParam {
+
+    /** 标题关键字 */
+    private String keyword;
+    private String status;
+    private Long categoryId;
+    /** 是否只看热门 */
+    private Boolean isHot;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaRespVO.java b/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaRespVO.java
new file mode 100644
index 0000000..0b99599
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaRespVO.java
@@ -0,0 +1,41 @@
+package com.reelshort.content.vo;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+/**
+ * 短剧列表/详情响应，字段名与后台页面表格列一致。
+ */
+@Data
+public class DramaRespVO {
+
+    private Long id;
+    private String code;
+    private String title;
+    private String subtitle;
+    private Long categoryId;
+    private String category;
+    private String genre;
+    private String description;
+    private String cover;
+    private String language;
+    private Integer episodes;
+    private Integer freeEpisodes;
+    private Integer unlockCoin;
+    private Boolean isHot;
+    private String status;
+    private String statusText;
+    private Long views;
+    private Integer sort;
+
+    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    private LocalDateTime publishAt;
+
+    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    private LocalDateTime createdAt;
+
+    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    private LocalDateTime updatedAt;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaSaveReqVO.java b/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaSaveReqVO.java
new file mode 100644
index 0000000..05dd9f9
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaSaveReqVO.java
@@ -0,0 +1,23 @@
+package com.reelshort.content.vo;
+
+import jakarta.validation.constraints.NotBlank;
+import lombok.Data;
+
+@Data
+public class DramaSaveReqVO {
+
+    @NotBlank(message = "请填写短剧名称")
+    private String title;
+
+    private String subtitle;
+    private Long categoryId;
+    private String genre;
+    private String description;
+    private String cover;
+    private String language;
+    private Integer freeEpisodes;
+    private Integer unlockCoin;
+    /** 是否热门 */
+    private Boolean isHot;
+    private Integer sort;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaStatusReqVO.java b/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaStatusReqVO.java
new file mode 100644
index 0000000..f21882d
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/vo/DramaStatusReqVO.java
@@ -0,0 +1,10 @@
+package com.reelshort.content.vo;
+
+import lombok.Data;
+
+@Data
+public class DramaStatusReqVO {
+
+    /** 驳回原因，其他动作可空 */
+    private String reason;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/vo/EpisodeRespVO.java b/reelshort-module-content/src/main/java/com/reelshort/content/vo/EpisodeRespVO.java
new file mode 100644
index 0000000..715a9cb
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/vo/EpisodeRespVO.java
@@ -0,0 +1,23 @@
+package com.reelshort.content.vo;
+
+import lombok.Data;
+
+@Data
+public class EpisodeRespVO {
+
+    private Long id;
+    private Long dramaId;
+    private Integer number;
+    private String title;
+    /** 展示用时长，mm:ss */
+    private String duration;
+    private Integer durationSec;
+    private String cover;
+    private String videoUrl;
+    private Boolean isFree;
+    private Integer unlockCoin;
+    private String status;
+    private String statusText;
+    private Long views;
+    private Integer sort;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/vo/EpisodeSaveReqVO.java b/reelshort-module-content/src/main/java/com/reelshort/content/vo/EpisodeSaveReqVO.java
new file mode 100644
index 0000000..65701a0
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/vo/EpisodeSaveReqVO.java
@@ -0,0 +1,23 @@
+package com.reelshort.content.vo;
+
+import jakarta.validation.constraints.NotNull;
+import lombok.Data;
+
+@Data
+public class EpisodeSaveReqVO {
+
+    @NotNull(message = "请选择所属短剧")
+    private Long dramaId;
+
+    @NotNull(message = "请填写集号")
+    private Integer number;
+
+    private String title;
+    private Integer durationSec;
+    private String cover;
+    private String videoUrl;
+    private Boolean isFree;
+    private Integer unlockCoin;
+    private String status;
+    private Integer sort;
+}
diff --git a/reelshort-module-content/src/main/java/com/reelshort/content/vo/EpisodeSortReqVO.java b/reelshort-module-content/src/main/java/com/reelshort/content/vo/EpisodeSortReqVO.java
new file mode 100644
index 0000000..437c5ff
--- /dev/null
+++ b/reelshort-module-content/src/main/java/com/reelshort/content/vo/EpisodeSortReqVO.java
@@ -0,0 +1,13 @@
+package com.reelshort.content.vo;
+
+import jakarta.validation.constraints.NotEmpty;
+import lombok.Data;
+
+import java.util.List;
+
+@Data
+public class EpisodeSortReqVO {
+
+    @NotEmpty(message = "请提供排序后的剧集 ID 列表")
+    private List<Long> ids;
+}
diff --git a/reelshort-module-media/pom.xml b/reelshort-module-media/pom.xml
new file mode 100644
index 0000000..1e397cc
--- /dev/null
+++ b/reelshort-module-media/pom.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>com.reelshort</groupId>
+        <artifactId>reelshort</artifactId>
+        <version>1.0.0-SNAPSHOT</version>
+    </parent>
+
+    <artifactId>reelshort-module-media</artifactId>
+    <name>reelshort-module-media</name>
+    <description>媒资域：分片上传、本地存储、访问地址</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>com.reelshort</groupId>
+            <artifactId>reelshort-framework</artifactId>
+        </dependency>
+    </dependencies>
+</project>
diff --git a/reelshort-module-media/src/main/java/com/reelshort/media/config/MediaProperties.java b/reelshort-module-media/src/main/java/com/reelshort/media/config/MediaProperties.java
new file mode 100644
index 0000000..6a435d6
--- /dev/null
+++ b/reelshort-module-media/src/main/java/com/reelshort/media/config/MediaProperties.java
@@ -0,0 +1,23 @@
+package com.reelshort.media.config;
+
+import lombok.Data;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.stereotype.Component;
+
+@Data
+@Component
+@ConfigurationProperties(prefix = "reelshort.media")
+public class MediaProperties {
+
+    /** 本地存储根目录，可以是相对路径（相对应用启动目录）。 */
+    private String rootDir = "./data/uploads";
+
+    /** 对外访问前缀，与静态资源映射保持一致。 */
+    private String publicPrefix = "/files";
+
+    /** 分片大小（字节），默认 5MB。 */
+    private long chunkSize = 5L * 1024 * 1024;
+
+    /** 单个文件大小上限（字节），默认 2GB。 */
+    private long maxFileSize = 2L * 1024 * 1024 * 1024;
+}
diff --git a/reelshort-module-media/src/main/java/com/reelshort/media/config/MediaWebConfig.java b/reelshort-module-media/src/main/java/com/reelshort/media/config/MediaWebConfig.java
new file mode 100644
index 0000000..d33c193
--- /dev/null
+++ b/reelshort-module-media/src/main/java/com/reelshort/media/config/MediaWebConfig.java
@@ -0,0 +1,38 @@
+package com.reelshort.media.config;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.nio.file.Files;
+import java.io.IOException;
+
+/**
+ * 把本地媒资目录映射成静态资源，前端直接用 /files/** 访问。
+ */
+@Configuration
+@RequiredArgsConstructor
+public class MediaWebConfig implements WebMvcConfigurer {
+
+    private final MediaProperties properties;
+
+    @Override
+    public void addResourceHandlers(ResourceHandlerRegistry registry) {
+        Path root = Paths.get(properties.getRootDir()).toAbsolutePath().normalize();
+        // Spring 6 会跳过启动时还不存在的静态资源目录，这里先确保目录存在
+        try {
+            Files.createDirectories(root);
+        } catch (IOException ex) {
+            throw new IllegalStateException("无法创建媒资目录: " + root, ex);
+        }
+        String prefix = properties.getPublicPrefix();
+        if (!prefix.endsWith("/")) {
+            prefix = prefix + "/";
+        }
+        registry.addResourceHandler(prefix + "**")
+                .addResourceLocations(root.toUri().toString());
+    }
+}
diff --git a/reelshort-module-media/src/main/java/com/reelshort/media/dal/entity/MediaAsset.java b/reelshort-module-media/src/main/java/com/reelshort/media/dal/entity/MediaAsset.java
new file mode 100644
index 0000000..6db0d61
--- /dev/null
+++ b/reelshort-module-media/src/main/java/com/reelshort/media/dal/entity/MediaAsset.java
@@ -0,0 +1,39 @@
+package com.reelshort.media.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.FieldStrategy;
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableLogic;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+@TableName("media_asset")
+public class MediaAsset {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private String bizType;
+    private String fileName;
+    private String objectKey;
+    private String sourceUrl;
+    private Long sizeBytes;
+    private String md5;
+    private Integer durationSec;
+    private Integer width;
+    private Integer height;
+    private String status;
+    private String hlsUrl;
+    private String mp4Url;
+    private String posterUrl;
+    private Long createBy;
+    private LocalDateTime createdAt;
+    /** updated_at 交给数据库的 ON UPDATE CURRENT_TIMESTAMP 维护 */
+    @TableField(updateStrategy = FieldStrategy.NEVER)
+    private LocalDateTime updatedAt;
+    @TableLogic
+    private Integer deleted;
+}
diff --git a/reelshort-module-media/src/main/java/com/reelshort/media/dal/entity/MediaUploadTask.java b/reelshort-module-media/src/main/java/com/reelshort/media/dal/entity/MediaUploadTask.java
new file mode 100644
index 0000000..8444ad7
--- /dev/null
+++ b/reelshort-module-media/src/main/java/com/reelshort/media/dal/entity/MediaUploadTask.java
@@ -0,0 +1,33 @@
+package com.reelshort.media.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.FieldStrategy;
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+@TableName("media_upload_task")
+public class MediaUploadTask {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private String uploadId;
+    private String bizType;
+    private String fileName;
+    private Long fileSize;
+    private Integer chunkSize;
+    private Integer totalChunks;
+    private Integer receivedChunks;
+    private String objectKey;
+    private String status;
+    private Long assetId;
+    private Long createBy;
+    private LocalDateTime createdAt;
+    /** updated_at 交给数据库的 ON UPDATE CURRENT_TIMESTAMP 维护 */
+    @TableField(updateStrategy = FieldStrategy.NEVER)
+    private LocalDateTime updatedAt;
+}
diff --git a/reelshort-module-media/src/main/java/com/reelshort/media/dal/mapper/MediaAssetMapper.java b/reelshort-module-media/src/main/java/com/reelshort/media/dal/mapper/MediaAssetMapper.java
new file mode 100644
index 0000000..fdcc680
--- /dev/null
+++ b/reelshort-module-media/src/main/java/com/reelshort/media/dal/mapper/MediaAssetMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.media.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.media.dal.entity.MediaAsset;
+
+public interface MediaAssetMapper extends BaseMapper<MediaAsset> {
+}
diff --git a/reelshort-module-media/src/main/java/com/reelshort/media/dal/mapper/MediaUploadTaskMapper.java b/reelshort-module-media/src/main/java/com/reelshort/media/dal/mapper/MediaUploadTaskMapper.java
new file mode 100644
index 0000000..58c9f27
--- /dev/null
+++ b/reelshort-module-media/src/main/java/com/reelshort/media/dal/mapper/MediaUploadTaskMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.media.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.media.dal.entity.MediaUploadTask;
+
+public interface MediaUploadTaskMapper extends BaseMapper<MediaUploadTask> {
+}
diff --git a/reelshort-module-media/src/main/java/com/reelshort/media/service/MediaService.java b/reelshort-module-media/src/main/java/com/reelshort/media/service/MediaService.java
new file mode 100644
index 0000000..c7caf83
--- /dev/null
+++ b/reelshort-module-media/src/main/java/com/reelshort/media/service/MediaService.java
@@ -0,0 +1,169 @@
+package com.reelshort.media.service;
+
+import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import com.reelshort.media.config.MediaProperties;
+import com.reelshort.media.dal.entity.MediaAsset;
+import com.reelshort.media.dal.entity.MediaUploadTask;
+import com.reelshort.media.dal.mapper.MediaAssetMapper;
+import com.reelshort.media.dal.mapper.MediaUploadTaskMapper;
+import com.reelshort.media.vo.MediaAssetRespVO;
+import com.reelshort.media.vo.UploadCompleteReqVO;
+import com.reelshort.media.vo.UploadInitReqVO;
+import com.reelshort.media.vo.UploadInitRespVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.web.multipart.MultipartFile;
+
+import java.util.Set;
+import java.util.UUID;
+
+@Service
+@RequiredArgsConstructor
+public class MediaService {
+
+    private static final String STATUS_READY = "ready";
+    private static final String STATUS_UPLOADED = "uploaded";
+    private static final String TASK_UPLOADING = "uploading";
+    private static final String TASK_COMPLETED = "completed";
+    private static final Set<String> IMAGE_EXTENSIONS =
+            Set.of(".jpg", ".jpeg", ".png", ".webp", ".gif", ".bmp", ".avif");
+
+    private final MediaProperties properties;
+    private final MediaStorageService storageService;
+    private final MediaAssetMapper mediaAssetMapper;
+    private final MediaUploadTaskMapper mediaUploadTaskMapper;
+
+    public UploadInitRespVO init(UploadInitReqVO req, Long userId) {
+        if (req.getFileSize() > properties.getMaxFileSize()) {
+            throw new ServiceException(ErrorCode.BAD_REQUEST,
+                    "文件超过上限 " + (properties.getMaxFileSize() / 1024 / 1024) + "MB");
+        }
+        long chunkSize = req.getChunkSize() != null && req.getChunkSize() > 0
+                ? Math.min(req.getChunkSize(), properties.getChunkSize())
+                : properties.getChunkSize();
+        int totalChunks = (int) Math.ceil((double) req.getFileSize() / chunkSize);
+
+        MediaUploadTask task = new MediaUploadTask();
+        task.setUploadId(UUID.randomUUID().toString().replace("-", ""));
+        task.setBizType(normalizeBizType(req.getBizType()));
+        task.setFileName(req.getFileName());
+        task.setFileSize(req.getFileSize());
+        task.setChunkSize((int) chunkSize);
+        task.setTotalChunks(totalChunks);
+        task.setReceivedChunks(0);
+        task.setObjectKey(storageService.buildObjectKey(task.getBizType(), req.getFileName()));
+        task.setStatus(TASK_UPLOADING);
+        task.setAssetId(0L);
+        task.setCreateBy(userId == null ? 0L : userId);
+        mediaUploadTaskMapper.insert(task);
+
+        return new UploadInitRespVO(task.getUploadId(), chunkSize, totalChunks, task.getObjectKey());
+    }
+
+    public void saveChunk(String uploadId, int index, MultipartFile file) {
+        MediaUploadTask task = getTask(uploadId);
+        if (index < 0 || index >= task.getTotalChunks()) {
+            throw new ServiceException(ErrorCode.BAD_REQUEST, "分片序号越界: " + index);
+        }
+        if (file == null || file.isEmpty()) {
+            throw new ServiceException(ErrorCode.BAD_REQUEST, "分片内容为空");
+        }
+        storageService.saveChunk(uploadId, index, file);
+        task.setReceivedChunks(storageService.countChunks(uploadId));
+        mediaUploadTaskMapper.updateById(task);
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public MediaAssetRespVO complete(UploadCompleteReqVO req) {
+        MediaUploadTask task = getTask(req.getUploadId());
+        if (TASK_COMPLETED.equals(task.getStatus()) && task.getAssetId() > 0) {
+            return get(task.getAssetId());
+        }
+        int chunks = storageService.countChunks(req.getUploadId());
+        if (chunks < task.getTotalChunks()) {
+            throw new ServiceException(ErrorCode.BAD_REQUEST,
+                    "分片未传完（" + chunks + "/" + task.getTotalChunks() + "）");
+        }
+
+        MediaStorageService.MergeResult merged =
+                storageService.merge(req.getUploadId(), task.getObjectKey(), task.getTotalChunks());
+        String publicUrl = storageService.toPublicUrl(task.getObjectKey());
+
+        MediaAsset asset = new MediaAsset();
+        asset.setBizType(task.getBizType());
+        asset.setFileName(task.getFileName());
+        asset.setObjectKey(task.getObjectKey());
+        asset.setSourceUrl(publicUrl);
+        asset.setSizeBytes(merged.size());
+        asset.setMd5(merged.md5());
+        asset.setDurationSec(req.getDurationSec() == null ? 0 : req.getDurationSec());
+        asset.setWidth(0);
+        asset.setHeight(0);
+        asset.setStatus(isImage(task.getFileName()) ? STATUS_READY : STATUS_UPLOADED);
+        asset.setHlsUrl("");
+        // 没有转码前，mp4_url 直接指向原文件，播放器可以先跑通
+        asset.setMp4Url(publicUrl);
+        asset.setPosterUrl("");
+        asset.setCreateBy(task.getCreateBy());
+        mediaAssetMapper.insert(asset);
+
+        task.setStatus(TASK_COMPLETED);
+        task.setAssetId(asset.getId());
+        task.setReceivedChunks(chunks);
+        mediaUploadTaskMapper.updateById(task);
+        storageService.cleanChunkDir(req.getUploadId());
+
+        // 重新查一次，拿到数据库生成的 created_at
+        return toResp(mediaAssetMapper.selectById(asset.getId()));
+    }
+
+    public MediaAssetRespVO get(Long id) {
+        MediaAsset asset = id == null ? null : mediaAssetMapper.selectById(id);
+        if (asset == null) {
+            throw new ServiceException(ErrorCode.DATA_NOT_FOUND, "媒资不存在");
+        }
+        return toResp(asset);
+    }
+
+    private MediaUploadTask getTask(String uploadId) {
+        MediaUploadTask task = mediaUploadTaskMapper.selectOne(
+                Wrappers.<MediaUploadTask>lambdaQuery().eq(MediaUploadTask::getUploadId, uploadId));
+        if (task == null) {
+            throw new ServiceException(ErrorCode.DATA_NOT_FOUND, "上传会话不存在或已过期");
+        }
+        return task;
+    }
+
+    private String normalizeBizType(String bizType) {
+        if (bizType == null || bizType.isBlank()) {
+            return "EPISODE";
+        }
+        return bizType.trim().toUpperCase();
+    }
+
+    private boolean isImage(String fileName) {
+        if (fileName == null) {
+            return false;
+        }
+        String lower = fileName.toLowerCase();
+        return IMAGE_EXTENSIONS.stream().anyMatch(lower::endsWith);
+    }
+
+    private MediaAssetRespVO toResp(MediaAsset asset) {
+        MediaAssetRespVO vo = new MediaAssetRespVO();
+        vo.setId(asset.getId());
+        vo.setBizType(asset.getBizType());
+        vo.setFileName(asset.getFileName());
+        vo.setObjectKey(asset.getObjectKey());
+        vo.setUrl(asset.getSourceUrl());
+        vo.setSizeBytes(asset.getSizeBytes());
+        vo.setMd5(asset.getMd5());
+        vo.setDurationSec(asset.getDurationSec());
+        vo.setStatus(asset.getStatus());
+        vo.setCreatedAt(asset.getCreatedAt());
+        return vo;
+    }
+}
diff --git a/reelshort-module-media/src/main/java/com/reelshort/media/service/MediaStorageService.java b/reelshort-module-media/src/main/java/com/reelshort/media/service/MediaStorageService.java
new file mode 100644
index 0000000..0e49809
--- /dev/null
+++ b/reelshort-module-media/src/main/java/com/reelshort/media/service/MediaStorageService.java
@@ -0,0 +1,173 @@
+package com.reelshort.media.service;
+
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import com.reelshort.media.config.MediaProperties;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+import org.springframework.web.multipart.MultipartFile;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.nio.file.StandardCopyOption;
+import java.nio.file.StandardOpenOption;
+import java.security.DigestOutputStream;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.time.LocalDate;
+import java.time.format.DateTimeFormatter;
+import java.util.HexFormat;
+import java.util.UUID;
+
+/**
+ * 本地磁盘媒资存储：分片写临时目录，完成后合并成正式文件。
+ * 之后要换成对象存储时，只需替换本类实现。
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class MediaStorageService {
+
+    private static final DateTimeFormatter MONTH_DIR = DateTimeFormatter.ofPattern("yyyyMM");
+
+    private final MediaProperties properties;
+
+    public record MergeResult(Path path, long size, String md5) {
+    }
+
+    public Path rootDir() {
+        Path root = Paths.get(properties.getRootDir()).toAbsolutePath().normalize();
+        try {
+            Files.createDirectories(root);
+            Files.createDirectories(root.resolve("tmp"));
+        } catch (IOException ex) {
+            throw new ServiceException("无法创建媒资目录: " + root);
+        }
+        return root;
+    }
+
+    public Path chunkDir(String uploadId) {
+        return rootDir().resolve("tmp").resolve(uploadId);
+    }
+
+    public void saveChunk(String uploadId, int index, MultipartFile file) {
+        Path dir = chunkDir(uploadId);
+        try {
+            Files.createDirectories(dir);
+            Path target = dir.resolve(index + ".part");
+            try (InputStream in = file.getInputStream()) {
+                Files.copy(in, target, StandardCopyOption.REPLACE_EXISTING);
+            }
+        } catch (IOException ex) {
+            throw new ServiceException("写入分片失败: " + index);
+        }
+    }
+
+    public int countChunks(String uploadId) {
+        Path dir = chunkDir(uploadId);
+        if (!Files.isDirectory(dir)) {
+            return 0;
+        }
+        try (var stream = Files.list(dir)) {
+            return (int) stream.filter(path -> path.getFileName().toString().endsWith(".part")).count();
+        } catch (IOException ex) {
+            return 0;
+        }
+    }
+
+    /** 按分片序号顺序合并，同时计算 MD5。 */
+    public MergeResult merge(String uploadId, String objectKey, int totalChunks) {
+        Path target = rootDir().resolve(objectKey).normalize();
+        if (!target.startsWith(rootDir())) {
+            throw new ServiceException(ErrorCode.BAD_REQUEST, "非法的存储路径");
+        }
+        MessageDigest digest = digest();
+        long size = 0;
+        try {
+            Files.createDirectories(target.getParent());
+            try (OutputStream fileOut = Files.newOutputStream(target,
+                    StandardOpenOption.CREATE, StandardOpenOption.TRUNCATE_EXISTING);
+                 DigestOutputStream out = new DigestOutputStream(fileOut, digest)) {
+                for (int index = 0; index < totalChunks; index++) {
+                    Path part = chunkDir(uploadId).resolve(index + ".part");
+                    if (!Files.exists(part)) {
+                        throw new ServiceException(ErrorCode.BAD_REQUEST, "分片 " + index + " 缺失");
+                    }
+                    size += Files.copy(part, out);
+                }
+            }
+        } catch (ServiceException ex) {
+            throw ex;
+        } catch (IOException ex) {
+            throw new ServiceException("合并分片失败");
+        }
+        return new MergeResult(target, size, HexFormat.of().formatHex(digest.digest()));
+    }
+
+    public void cleanChunkDir(String uploadId) {
+        Path dir = chunkDir(uploadId);
+        if (!Files.isDirectory(dir)) {
+            return;
+        }
+        try (var stream = Files.walk(dir)) {
+            stream.sorted((a, b) -> b.getNameCount() - a.getNameCount())
+                    .forEach(path -> {
+                        try {
+                            Files.deleteIfExists(path);
+                        } catch (IOException ignored) {
+                            // 临时文件清理失败不影响主流程
+                        }
+                    });
+        } catch (IOException ex) {
+            log.warn("清理分片目录失败: {}", dir, ex);
+        }
+    }
+
+    public void delete(String objectKey) {
+        try {
+            Files.deleteIfExists(rootDir().resolve(objectKey).normalize());
+        } catch (IOException ex) {
+            log.warn("删除媒资文件失败: {}", objectKey, ex);
+        }
+    }
+
+    /** 生成对象键：bizType/yyyyMM/uuid.ext */
+    public String buildObjectKey(String bizType, String originalName) {
+        String type = (bizType == null || bizType.isBlank() ? "misc" : bizType).toLowerCase();
+        return type + "/" + LocalDate.now().format(MONTH_DIR) + "/"
+                + UUID.randomUUID().toString().replace("-", "") + extension(originalName);
+    }
+
+    public String toPublicUrl(String objectKey) {
+        String prefix = properties.getPublicPrefix();
+        if (prefix.endsWith("/")) {
+            prefix = prefix.substring(0, prefix.length() - 1);
+        }
+        return prefix + "/" + objectKey;
+    }
+
+    private String extension(String fileName) {
+        if (fileName == null) {
+            return "";
+        }
+        int dot = fileName.lastIndexOf('.');
+        if (dot < 0 || dot == fileName.length() - 1) {
+            return "";
+        }
+        String ext = fileName.substring(dot).toLowerCase();
+        return ext.length() > 12 ? "" : ext;
+    }
+
+    private MessageDigest digest() {
+        try {
+            return MessageDigest.getInstance("MD5");
+        } catch (NoSuchAlgorithmException ex) {
+            throw new ServiceException("当前 JVM 不支持 MD5");
+        }
+    }
+}
diff --git a/reelshort-module-media/src/main/java/com/reelshort/media/vo/MediaAssetRespVO.java b/reelshort-module-media/src/main/java/com/reelshort/media/vo/MediaAssetRespVO.java
new file mode 100644
index 0000000..6c32302
--- /dev/null
+++ b/reelshort-module-media/src/main/java/com/reelshort/media/vo/MediaAssetRespVO.java
@@ -0,0 +1,23 @@
+package com.reelshort.media.vo;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+public class MediaAssetRespVO {
+
+    private Long id;
+    private String bizType;
+    private String fileName;
+    private String objectKey;
+    private String url;
+    private Long sizeBytes;
+    private String md5;
+    private Integer durationSec;
+    private String status;
+
+    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    private LocalDateTime createdAt;
+}
diff --git a/reelshort-module-media/src/main/java/com/reelshort/media/vo/UploadCompleteReqVO.java b/reelshort-module-media/src/main/java/com/reelshort/media/vo/UploadCompleteReqVO.java
new file mode 100644
index 0000000..4dbcb79
--- /dev/null
+++ b/reelshort-module-media/src/main/java/com/reelshort/media/vo/UploadCompleteReqVO.java
@@ -0,0 +1,14 @@
+package com.reelshort.media.vo;
+
+import jakarta.validation.constraints.NotBlank;
+import lombok.Data;
+
+@Data
+public class UploadCompleteReqVO {
+
+    @NotBlank(message = "缺少 uploadId")
+    private String uploadId;
+
+    /** 客户端探测到的时长（视频用） */
+    private Integer durationSec;
+}
diff --git a/reelshort-module-media/src/main/java/com/reelshort/media/vo/UploadInitReqVO.java b/reelshort-module-media/src/main/java/com/reelshort/media/vo/UploadInitReqVO.java
new file mode 100644
index 0000000..4c9b8d3
--- /dev/null
+++ b/reelshort-module-media/src/main/java/com/reelshort/media/vo/UploadInitReqVO.java
@@ -0,0 +1,21 @@
+package com.reelshort.media.vo;
+
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Positive;
+import lombok.Data;
+
+@Data
+public class UploadInitReqVO {
+
+    @NotBlank(message = "缺少文件名")
+    private String fileName;
+
+    @Positive(message = "文件大小不合法")
+    private long fileSize;
+
+    /** DRAMA_COVER / EPISODE / AVATAR */
+    private String bizType = "EPISODE";
+
+    /** 客户端期望的分片大小，留空则用服务端配置 */
+    private Long chunkSize;
+}
diff --git a/reelshort-module-media/src/main/java/com/reelshort/media/vo/UploadInitRespVO.java b/reelshort-module-media/src/main/java/com/reelshort/media/vo/UploadInitRespVO.java
new file mode 100644
index 0000000..2749d44
--- /dev/null
+++ b/reelshort-module-media/src/main/java/com/reelshort/media/vo/UploadInitRespVO.java
@@ -0,0 +1,14 @@
+package com.reelshort.media.vo;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+
+@Data
+@AllArgsConstructor
+public class UploadInitRespVO {
+
+    private String uploadId;
+    private long chunkSize;
+    private int totalChunks;
+    private String objectKey;
+}
diff --git a/reelshort-module-system/pom.xml b/reelshort-module-system/pom.xml
new file mode 100644
index 0000000..e3beee4
--- /dev/null
+++ b/reelshort-module-system/pom.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>com.reelshort</groupId>
+        <artifactId>reelshort</artifactId>
+        <version>1.0.0-SNAPSHOT</version>
+    </parent>
+
+    <artifactId>reelshort-module-system</artifactId>
+    <name>reelshort-module-system</name>
+    <description>系统域：管理员、角色、权限、菜单、配置</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>com.reelshort</groupId>
+            <artifactId>reelshort-framework</artifactId>
+        </dependency>
+    </dependencies>
+</project>
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/AdminUser.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/AdminUser.java
new file mode 100644
index 0000000..b71b7c0
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/AdminUser.java
@@ -0,0 +1,36 @@
+package com.reelshort.system.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.FieldStrategy;
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableLogic;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+@TableName("sys_admin_user")
+public class AdminUser {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private String username;
+    private String password;
+    private String realName;
+    private String mobile;
+    private String email;
+    private String avatar;
+    private Integer status;
+    private String ipWhitelist;
+    private Integer twoFactor;
+    private LocalDateTime lastLoginAt;
+    private String lastLoginIp;
+    private LocalDateTime createdAt;
+    /** updated_at 交给数据库的 ON UPDATE CURRENT_TIMESTAMP 维护 */
+    @TableField(updateStrategy = FieldStrategy.NEVER)
+    private LocalDateTime updatedAt;
+    @TableLogic
+    private Integer deleted;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/AdminUserRole.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/AdminUserRole.java
new file mode 100644
index 0000000..f3656ec
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/AdminUserRole.java
@@ -0,0 +1,25 @@
+package com.reelshort.system.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+@TableName("sys_admin_user_role")
+public class AdminUserRole {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private Long userId;
+    private Long roleId;
+
+    public AdminUserRole(Long userId, Long roleId) {
+        this.userId = userId;
+        this.roleId = roleId;
+    }
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/Menu.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/Menu.java
new file mode 100644
index 0000000..9432907
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/Menu.java
@@ -0,0 +1,36 @@
+package com.reelshort.system.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.FieldStrategy;
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+@TableName("sys_menu")
+public class Menu {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private Long parentId;
+    private String title;
+    private String routePath;
+    private String routeName;
+    private String component;
+    private String redirect;
+    private String icon;
+    private String permissionCode;
+    private String type;
+    private Integer alwaysShow;
+    private Integer affix;
+    private Integer sort;
+    private Integer visible;
+    private Integer status;
+    private LocalDateTime createdAt;
+    /** updated_at 交给数据库的 ON UPDATE CURRENT_TIMESTAMP 维护 */
+    @TableField(updateStrategy = FieldStrategy.NEVER)
+    private LocalDateTime updatedAt;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/OperationLog.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/OperationLog.java
new file mode 100644
index 0000000..02c6e54
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/OperationLog.java
@@ -0,0 +1,31 @@
+package com.reelshort.system.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+@TableName("sys_operation_log")
+public class OperationLog {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private Long adminUserId;
+    private String username;
+    private String module;
+    private String action;
+    private String requestMethod;
+    private String requestUrl;
+    private String requestParams;
+    private String requestBody;
+    private String responseBody;
+    /** SUCCESS / FAIL */
+    private String status;
+    private String errorMsg;
+    private Integer durationMs;
+    private String ip;
+    private LocalDateTime createdAt;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/Permission.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/Permission.java
new file mode 100644
index 0000000..e997d37
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/Permission.java
@@ -0,0 +1,19 @@
+package com.reelshort.system.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+@Data
+@TableName("sys_permission")
+public class Permission {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private String code;
+    private String name;
+    private String groupName;
+    private String type;
+    private Integer sort;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/Role.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/Role.java
new file mode 100644
index 0000000..7476e84
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/Role.java
@@ -0,0 +1,32 @@
+package com.reelshort.system.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.FieldStrategy;
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableLogic;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+@TableName("sys_role")
+public class Role {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private String name;
+    private String code;
+    private Long categoryId;
+    private Integer level;
+    private String description;
+    private Integer status;
+    private Integer isBuiltin;
+    private LocalDateTime createdAt;
+    /** updated_at 交给数据库的 ON UPDATE CURRENT_TIMESTAMP 维护 */
+    @TableField(updateStrategy = FieldStrategy.NEVER)
+    private LocalDateTime updatedAt;
+    @TableLogic
+    private Integer deleted;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/RoleCategory.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/RoleCategory.java
new file mode 100644
index 0000000..3154957
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/RoleCategory.java
@@ -0,0 +1,28 @@
+package com.reelshort.system.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.FieldStrategy;
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableLogic;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+@TableName("sys_role_category")
+public class RoleCategory {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private String name;
+    private String description;
+    private Integer sort;
+    private LocalDateTime createdAt;
+    /** updated_at 交给数据库的 ON UPDATE CURRENT_TIMESTAMP 维护 */
+    @TableField(updateStrategy = FieldStrategy.NEVER)
+    private LocalDateTime updatedAt;
+    @TableLogic
+    private Integer deleted;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/RoleMenu.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/RoleMenu.java
new file mode 100644
index 0000000..501e02d
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/RoleMenu.java
@@ -0,0 +1,25 @@
+package com.reelshort.system.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+@TableName("sys_role_menu")
+public class RoleMenu {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private Long roleId;
+    private Long menuId;
+
+    public RoleMenu(Long roleId, Long menuId) {
+        this.roleId = roleId;
+        this.menuId = menuId;
+    }
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/RolePermission.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/RolePermission.java
new file mode 100644
index 0000000..0f6dae5
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/RolePermission.java
@@ -0,0 +1,25 @@
+package com.reelshort.system.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+@TableName("sys_role_permission")
+public class RolePermission {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private Long roleId;
+    private Long permissionId;
+
+    public RolePermission(Long roleId, Long permissionId) {
+        this.roleId = roleId;
+        this.permissionId = permissionId;
+    }
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/SysConfig.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/SysConfig.java
new file mode 100644
index 0000000..1fbe8f5
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/entity/SysConfig.java
@@ -0,0 +1,17 @@
+package com.reelshort.system.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+@Data
+@TableName("sys_config")
+public class SysConfig {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+    private String configKey;
+    private String configValue;
+    private String remark;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/AdminUserMapper.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/AdminUserMapper.java
new file mode 100644
index 0000000..295ec0f
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/AdminUserMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.system.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.system.dal.entity.AdminUser;
+
+public interface AdminUserMapper extends BaseMapper<AdminUser> {
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/AdminUserRoleMapper.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/AdminUserRoleMapper.java
new file mode 100644
index 0000000..bb158df
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/AdminUserRoleMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.system.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.system.dal.entity.AdminUserRole;
+
+public interface AdminUserRoleMapper extends BaseMapper<AdminUserRole> {
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/MenuMapper.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/MenuMapper.java
new file mode 100644
index 0000000..a5f7abf
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/MenuMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.system.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.system.dal.entity.Menu;
+
+public interface MenuMapper extends BaseMapper<Menu> {
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/OperationLogMapper.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/OperationLogMapper.java
new file mode 100644
index 0000000..9ce1b94
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/OperationLogMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.system.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.system.dal.entity.OperationLog;
+
+public interface OperationLogMapper extends BaseMapper<OperationLog> {
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/PermissionMapper.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/PermissionMapper.java
new file mode 100644
index 0000000..a68a077
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/PermissionMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.system.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.system.dal.entity.Permission;
+
+public interface PermissionMapper extends BaseMapper<Permission> {
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/RoleCategoryMapper.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/RoleCategoryMapper.java
new file mode 100644
index 0000000..d9c5152
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/RoleCategoryMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.system.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.system.dal.entity.RoleCategory;
+
+public interface RoleCategoryMapper extends BaseMapper<RoleCategory> {
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/RoleMapper.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/RoleMapper.java
new file mode 100644
index 0000000..9961956
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/RoleMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.system.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.system.dal.entity.Role;
+
+public interface RoleMapper extends BaseMapper<Role> {
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/RoleMenuMapper.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/RoleMenuMapper.java
new file mode 100644
index 0000000..548e57d
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/RoleMenuMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.system.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.system.dal.entity.RoleMenu;
+
+public interface RoleMenuMapper extends BaseMapper<RoleMenu> {
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/RolePermissionMapper.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/RolePermissionMapper.java
new file mode 100644
index 0000000..c2da5e5
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/RolePermissionMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.system.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.system.dal.entity.RolePermission;
+
+public interface RolePermissionMapper extends BaseMapper<RolePermission> {
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/SysConfigMapper.java b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/SysConfigMapper.java
new file mode 100644
index 0000000..5e1090d
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/dal/mapper/SysConfigMapper.java
@@ -0,0 +1,7 @@
+package com.reelshort.system.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.reelshort.system.dal.entity.SysConfig;
+
+public interface SysConfigMapper extends BaseMapper<SysConfig> {
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/service/AdminUserService.java b/reelshort-module-system/src/main/java/com/reelshort/system/service/AdminUserService.java
new file mode 100644
index 0000000..e516122
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/service/AdminUserService.java
@@ -0,0 +1,197 @@
+package com.reelshort.system.service;
+
+import com.baomidou.mybatisplus.core.metadata.IPage;
+import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import com.reelshort.common.pojo.PageResult;
+import com.reelshort.system.dal.entity.AdminUser;
+import com.reelshort.system.dal.entity.AdminUserRole;
+import com.reelshort.system.dal.mapper.AdminUserMapper;
+import com.reelshort.system.dal.mapper.AdminUserRoleMapper;
+import com.reelshort.system.vo.AdminUserPageReqVO;
+import com.reelshort.system.vo.AdminUserRespVO;
+import com.reelshort.system.vo.AdminUserSaveReqVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.util.StringUtils;
+
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Map;
+
+@Service
+@RequiredArgsConstructor
+public class AdminUserService {
+
+    /** 内置超级管理员账号，不允许删除或停用。 */
+    public static final String BUILTIN_ADMIN = "admin";
+
+    private final AdminUserMapper adminUserMapper;
+    private final AdminUserRoleMapper adminUserRoleMapper;
+    private final RoleService roleService;
+    private final PasswordEncoder passwordEncoder;
+
+    public PageResult<AdminUserRespVO> page(AdminUserPageReqVO req) {
+        List<Long> userIdsOfRole = req.getRoleId() == null ? null
+                : adminUserRoleMapper.selectList(Wrappers.<AdminUserRole>lambdaQuery()
+                        .eq(AdminUserRole::getRoleId, req.getRoleId()))
+                .stream().map(AdminUserRole::getUserId).toList();
+        if (userIdsOfRole != null && userIdsOfRole.isEmpty()) {
+            return PageResult.empty();
+        }
+
+        Page<AdminUser> page = new Page<>(req.getSafePageIndex(), req.getSafePageSize());
+        IPage<AdminUser> result = adminUserMapper.selectPage(page, Wrappers.<AdminUser>lambdaQuery()
+                .like(StringUtils.hasText(req.getUsername()), AdminUser::getUsername, req.getUsername())
+                .eq(req.getStatus() != null, AdminUser::getStatus, req.getStatus())
+                .in(userIdsOfRole != null, AdminUser::getId, userIdsOfRole)
+                .orderByAsc(AdminUser::getId));
+        return new PageResult<>(result.getTotal(), toRespList(result.getRecords()));
+    }
+
+    public AdminUserRespVO get(Long id) {
+        AdminUser user = getExisting(id);
+        return toRespList(List.of(user)).get(0);
+    }
+
+    public AdminUser getByUsername(String username) {
+        return adminUserMapper.selectOne(
+                Wrappers.<AdminUser>lambdaQuery().eq(AdminUser::getUsername, username));
+    }
+
+    public AdminUser getExisting(Long id) {
+        AdminUser user = id == null ? null : adminUserMapper.selectById(id);
+        if (user == null) {
+            throw new ServiceException(ErrorCode.DATA_NOT_FOUND, "管理员不存在");
+        }
+        return user;
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public Long create(AdminUserSaveReqVO req) {
+        if (!StringUtils.hasText(req.getUsername())) {
+            throw new ServiceException(ErrorCode.BAD_REQUEST, "请输入登录账号");
+        }
+        if (!StringUtils.hasText(req.getPassword())) {
+            throw new ServiceException(ErrorCode.BAD_REQUEST, "请输入初始密码");
+        }
+        if (getByUsername(req.getUsername()) != null) {
+            throw new ServiceException(ErrorCode.DATA_EXISTS, "登录账号已存在");
+        }
+        roleService.getExisting(req.getRoleId());
+
+        AdminUser user = new AdminUser();
+        user.setUsername(req.getUsername());
+        user.setPassword(passwordEncoder.encode(req.getPassword()));
+        user.setRealName(req.getName());
+        user.setStatus(req.getStatus() == null ? 1 : req.getStatus());
+        user.setIpWhitelist(req.getIpWhitelist() == null ? "" : req.getIpWhitelist());
+        user.setTwoFactor(req.getTwoFactor() == null ? 0 : req.getTwoFactor());
+        user.setMobile("");
+        user.setEmail("");
+        user.setAvatar("");
+        user.setLastLoginIp("");
+        adminUserMapper.insert(user);
+        adminUserRoleMapper.insert(new AdminUserRole(user.getId(), req.getRoleId()));
+        return user.getId();
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public void update(Long id, AdminUserSaveReqVO req) {
+        AdminUser user = getExisting(id);
+        roleService.getExisting(req.getRoleId());
+        user.setRealName(req.getName());
+        if (req.getIpWhitelist() != null) {
+            user.setIpWhitelist(req.getIpWhitelist());
+        }
+        if (req.getTwoFactor() != null) {
+            user.setTwoFactor(req.getTwoFactor());
+        }
+        if (req.getStatus() != null) {
+            if (BUILTIN_ADMIN.equals(user.getUsername()) && req.getStatus() != 1) {
+                throw new ServiceException(ErrorCode.OPERATION_NOT_ALLOWED, "内置管理员账号不能停用");
+            }
+            user.setStatus(req.getStatus());
+        }
+        adminUserMapper.updateById(user);
+
+        adminUserRoleMapper.delete(Wrappers.<AdminUserRole>lambdaQuery().eq(AdminUserRole::getUserId, id));
+        adminUserRoleMapper.insert(new AdminUserRole(id, req.getRoleId()));
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public void delete(Long id) {
+        AdminUser user = getExisting(id);
+        if (BUILTIN_ADMIN.equals(user.getUsername())) {
+            throw new ServiceException(ErrorCode.OPERATION_NOT_ALLOWED, "内置管理员账号不能删除");
+        }
+        adminUserMapper.deleteById(id);
+        adminUserRoleMapper.delete(Wrappers.<AdminUserRole>lambdaQuery().eq(AdminUserRole::getUserId, id));
+    }
+
+    public void updateStatus(Long id, Integer status) {
+        AdminUser user = getExisting(id);
+        if (BUILTIN_ADMIN.equals(user.getUsername()) && status != null && status != 1) {
+            throw new ServiceException(ErrorCode.OPERATION_NOT_ALLOWED, "内置管理员账号不能停用");
+        }
+        user.setStatus(status == null ? 1 : status);
+        adminUserMapper.updateById(user);
+    }
+
+    public void resetPassword(Long id, String newPassword) {
+        AdminUser user = getExisting(id);
+        if (!StringUtils.hasText(newPassword) || newPassword.length() < 6) {
+            throw new ServiceException(ErrorCode.BAD_REQUEST, "新密码长度不能少于 6 位");
+        }
+        user.setPassword(passwordEncoder.encode(newPassword));
+        adminUserMapper.updateById(user);
+    }
+
+    public void changePassword(Long id, String oldPassword, String newPassword) {
+        AdminUser user = getExisting(id);
+        if (!passwordEncoder.matches(oldPassword, user.getPassword())) {
+            throw new ServiceException(ErrorCode.BAD_REQUEST, "原密码不正确");
+        }
+        user.setPassword(passwordEncoder.encode(newPassword));
+        adminUserMapper.updateById(user);
+    }
+
+    public void recordLogin(Long id, String ip) {
+        AdminUser user = adminUserMapper.selectById(id);
+        if (user == null) {
+            return;
+        }
+        user.setLastLoginAt(LocalDateTime.now());
+        user.setLastLoginIp(ip == null ? "" : ip);
+        adminUserMapper.updateById(user);
+    }
+
+    private List<AdminUserRespVO> toRespList(List<AdminUser> users) {
+        if (users.isEmpty()) {
+            return List.of();
+        }
+        Map<Long, String> roleNames = roleService.roleNameMap();
+        return users.stream().map(user -> {
+            List<Long> roleIds = roleService.listRoleIdsByUserId(user.getId());
+            Long roleId = roleIds.isEmpty() ? null : roleIds.get(0);
+            AdminUserRespVO vo = new AdminUserRespVO();
+            vo.setId(user.getId());
+            vo.setUsername(user.getUsername());
+            vo.setName(user.getRealName());
+            vo.setRoleId(roleId);
+            vo.setRole(roleId == null ? "" : roleNames.getOrDefault(roleId, ""));
+            vo.setIpWhitelist(StringUtils.hasText(user.getIpWhitelist()) ? user.getIpWhitelist() : "不限");
+            vo.setStatus(user.getStatus());
+            vo.setStatusText(user.getStatus() != null && user.getStatus() == 1 ? "启用" : "停用");
+            vo.setTwoFactor(user.getTwoFactor());
+            vo.setTwoFactorText(user.getTwoFactor() != null && user.getTwoFactor() == 1 ? "已开启" : "未开启");
+            vo.setCreatedAt(user.getCreatedAt());
+            vo.setLastLogin(user.getLastLoginAt());
+            return vo;
+        }).toList();
+    }
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/service/AuthService.java b/reelshort-module-system/src/main/java/com/reelshort/system/service/AuthService.java
new file mode 100644
index 0000000..bc9f4e9
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/service/AuthService.java
@@ -0,0 +1,80 @@
+package com.reelshort.system.service;
+
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import com.reelshort.framework.security.JwtTokenProvider;
+import com.reelshort.framework.security.LoginUser;
+import com.reelshort.system.dal.entity.AdminUser;
+import com.reelshort.system.dal.entity.Role;
+import com.reelshort.system.vo.LoginReqVO;
+import com.reelshort.system.vo.LoginRespVO;
+import com.reelshort.system.vo.MenuVO;
+import com.reelshort.system.vo.ProfileRespVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.stereotype.Service;
+
+import java.util.List;
+
+@Service
+@RequiredArgsConstructor
+public class AuthService {
+
+    private final AdminUserService adminUserService;
+    private final RoleService roleService;
+    private final MenuService menuService;
+    private final PasswordEncoder passwordEncoder;
+    private final JwtTokenProvider tokenProvider;
+
+    public LoginRespVO login(LoginReqVO req, String ip) {
+        AdminUser user = adminUserService.getByUsername(req.getUsername());
+        if (user == null || !passwordEncoder.matches(req.getPassword(), user.getPassword())) {
+            throw new ServiceException(ErrorCode.LOGIN_FAILED);
+        }
+        if (user.getStatus() == null || user.getStatus() != 1) {
+            throw new ServiceException(ErrorCode.ACCOUNT_DISABLED);
+        }
+        Role role = roleService.getRoleOfUser(user.getId());
+        List<String> permissions = role == null ? List.of() : roleService.listCodesByRoleId(role.getId());
+        LoginUser loginUser = new LoginUser(
+                user.getId(), user.getUsername(), role == null ? null : role.getCode(), permissions);
+        adminUserService.recordLogin(user.getId(), ip);
+
+        return LoginRespVO.builder()
+                .token(tokenProvider.createAdminToken(loginUser))
+                .userId(user.getId())
+                .username(user.getUsername())
+                .name(user.getRealName())
+                .avatar(user.getAvatar())
+                .role(role == null ? null : role.getCode())
+                .roleName(role == null ? null : role.getName())
+                .roleId(role == null ? null : role.getId())
+                .permissions(permissions)
+                .build();
+    }
+
+    public List<MenuVO> listMenus(Long userId) {
+        return menuService.listForUser(userId);
+    }
+
+    /** 当前登录人信息（含实时权限），前端每次进入应用会重新拉取。 */
+    public ProfileRespVO profile(Long userId) {
+        AdminUser user = adminUserService.getExisting(userId);
+        Role role = roleService.getRoleOfUser(userId);
+        List<String> permissions = role == null ? List.of() : roleService.listCodesByRoleId(role.getId());
+        return ProfileRespVO.builder()
+                .userId(user.getId())
+                .username(user.getUsername())
+                .name(user.getRealName())
+                .avatar(user.getAvatar())
+                .role(role == null ? null : role.getCode())
+                .roleName(role == null ? null : role.getName())
+                .roleId(role == null ? null : role.getId())
+                .permissions(permissions)
+                .build();
+    }
+
+    public void changePassword(Long userId, String oldPassword, String newPassword) {
+        adminUserService.changePassword(userId, oldPassword, newPassword);
+    }
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/service/ConfigService.java b/reelshort-module-system/src/main/java/com/reelshort/system/service/ConfigService.java
new file mode 100644
index 0000000..a3401a1
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/service/ConfigService.java
@@ -0,0 +1,49 @@
+package com.reelshort.system.service;
+
+import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.reelshort.system.dal.entity.SysConfig;
+import com.reelshort.system.dal.mapper.SysConfigMapper;
+import com.reelshort.system.vo.ConfigItemVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.util.List;
+import java.util.Map;
+
+@Service
+@RequiredArgsConstructor
+public class ConfigService {
+
+    private final SysConfigMapper sysConfigMapper;
+
+    public List<ConfigItemVO> list() {
+        return sysConfigMapper.selectList(null).stream()
+                .map(config -> new ConfigItemVO(config.getConfigKey(), config.getConfigValue(), config.getRemark()))
+                .toList();
+    }
+
+    public String get(String key, String defaultValue) {
+        SysConfig config = sysConfigMapper.selectOne(
+                Wrappers.<SysConfig>lambdaQuery().eq(SysConfig::getConfigKey, key));
+        return config == null || config.getConfigValue() == null ? defaultValue : config.getConfigValue();
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public void update(Map<String, String> values) {
+        values.forEach((key, value) -> {
+            SysConfig config = sysConfigMapper.selectOne(
+                    Wrappers.<SysConfig>lambdaQuery().eq(SysConfig::getConfigKey, key));
+            if (config == null) {
+                config = new SysConfig();
+                config.setConfigKey(key);
+                config.setConfigValue(value);
+                config.setRemark("");
+                sysConfigMapper.insert(config);
+            } else {
+                config.setConfigValue(value);
+                sysConfigMapper.updateById(config);
+            }
+        });
+    }
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/service/MenuService.java b/reelshort-module-system/src/main/java/com/reelshort/system/service/MenuService.java
new file mode 100644
index 0000000..8a5177d
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/service/MenuService.java
@@ -0,0 +1,143 @@
+package com.reelshort.system.service;
+
+import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import com.reelshort.system.dal.entity.Menu;
+import com.reelshort.system.dal.entity.Role;
+import com.reelshort.system.dal.mapper.MenuMapper;
+import com.reelshort.system.vo.MenuSaveReqVO;
+import com.reelshort.system.vo.MenuVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+@Service
+@RequiredArgsConstructor
+public class MenuService {
+
+    private final MenuMapper menuMapper;
+    private final RoleService roleService;
+
+    /** 当前用户可见的菜单路由树。 */
+    public List<MenuVO> listForUser(Long userId) {
+        Role role = roleService.getRoleOfUser(userId);
+        if (role == null) {
+            return List.of();
+        }
+        List<Menu> all = listEnabled();
+        if (RoleService.SUPER_ADMIN_CODE.equals(role.getCode())) {
+            return buildTree(all);
+        }
+        List<String> codes = roleService.listCodesByRoleId(role.getId());
+        return buildTree(all.stream()
+                .filter(menu -> codes.contains(menu.getPermissionCode()))
+                .toList());
+    }
+
+    /** 菜单管理页使用的完整菜单树。 */
+    public List<MenuVO> listAll() {
+        return buildTree(menuMapper.selectList(
+                Wrappers.<Menu>lambdaQuery().orderByAsc(Menu::getParentId).orderByAsc(Menu::getSort)));
+    }
+
+    public Long create(MenuSaveReqVO req) {
+        Menu menu = new Menu();
+        apply(menu, req);
+        menuMapper.insert(menu);
+        return menu.getId();
+    }
+
+    public void update(Long id, MenuSaveReqVO req) {
+        Menu menu = menuMapper.selectById(id);
+        if (menu == null) {
+            throw new ServiceException(ErrorCode.DATA_NOT_FOUND, "菜单不存在");
+        }
+        if (id.equals(req.getParentId())) {
+            throw new ServiceException(ErrorCode.BAD_REQUEST, "上级菜单不能是自己");
+        }
+        apply(menu, req);
+        menuMapper.updateById(menu);
+    }
+
+    public void delete(Long id) {
+        Long children = menuMapper.selectCount(
+                Wrappers.<Menu>lambdaQuery().eq(Menu::getParentId, id));
+        if (children != null && children > 0) {
+            throw new ServiceException(ErrorCode.OPERATION_NOT_ALLOWED, "请先删除子菜单");
+        }
+        menuMapper.deleteById(id);
+    }
+
+    private List<Menu> listEnabled() {
+        return menuMapper.selectList(Wrappers.<Menu>lambdaQuery()
+                .eq(Menu::getStatus, 1)
+                .eq(Menu::getVisible, 1)
+                .orderByAsc(Menu::getSort));
+    }
+
+    private void apply(Menu menu, MenuSaveReqVO req) {
+        menu.setParentId(req.getParentId() == null ? 0L : req.getParentId());
+        menu.setTitle(req.getTitle());
+        menu.setRoutePath(nullToEmpty(req.getRoutePath()));
+        menu.setRouteName(nullToEmpty(req.getRouteName()));
+        menu.setComponent(nullToEmpty(req.getComponent()));
+        menu.setRedirect(nullToEmpty(req.getRedirect()));
+        menu.setIcon(nullToEmpty(req.getIcon()));
+        menu.setPermissionCode(nullToEmpty(req.getPermissionCode()));
+        menu.setType(req.getType() == null ? "MENU" : req.getType());
+        menu.setSort(req.getSort() == null ? 1 : req.getSort());
+        menu.setVisible(req.getVisible() == null ? 1 : req.getVisible());
+        menu.setStatus(req.getStatus() == null ? 1 : req.getStatus());
+        boolean catalog = "CATALOG".equals(menu.getType());
+        menu.setAlwaysShow(catalog ? 1 : 0);
+        menu.setAffix(menu.getAffix() == null ? 0 : menu.getAffix());
+    }
+
+    private String nullToEmpty(String value) {
+        return value == null ? "" : value;
+    }
+
+    private List<MenuVO> buildTree(List<Menu> menus) {
+        Map<Long, MenuVO> nodes = new LinkedHashMap<>();
+        for (Menu menu : menus) {
+            MenuVO vo = new MenuVO();
+            vo.setId(menu.getId());
+            vo.setParentId(menu.getParentId());
+            vo.setPath(menu.getRoutePath());
+            vo.setName(menu.getRouteName());
+            vo.setComponent(menu.getComponent());
+            vo.setRedirect(menu.getRedirect());
+            vo.setIcon(menu.getIcon());
+            vo.setType(menu.getType());
+            vo.setPermissionCode(menu.getPermissionCode());
+            vo.setSort(menu.getSort());
+            vo.setVisible(menu.getVisible());
+            vo.setStatus(menu.getStatus());
+            vo.setMeta(new MenuVO.Meta(
+                    menu.getTitle(),
+                    menu.getIcon().isEmpty() ? null : menu.getIcon(),
+                    menu.getAlwaysShow() != null && menu.getAlwaysShow() == 1 ? Boolean.TRUE : null,
+                    menu.getAffix() != null && menu.getAffix() == 1 ? Boolean.TRUE : null));
+            nodes.put(menu.getId(), vo);
+        }
+        List<MenuVO> roots = new ArrayList<>();
+        for (Menu menu : menus) {
+            MenuVO node = nodes.get(menu.getId());
+            MenuVO parent = menu.getParentId() == null ? null : nodes.get(menu.getParentId());
+            if (parent == null) {
+                roots.add(node);
+            } else {
+                if (parent.getChildren() == null) {
+                    parent.setChildren(new ArrayList<>());
+                }
+                parent.getChildren().add(node);
+            }
+        }
+        return roots;
+    }
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/service/OperationLogService.java b/reelshort-module-system/src/main/java/com/reelshort/system/service/OperationLogService.java
new file mode 100644
index 0000000..1920e51
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/service/OperationLogService.java
@@ -0,0 +1,95 @@
+package com.reelshort.system.service;
+
+import com.baomidou.mybatisplus.core.metadata.IPage;
+import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import com.reelshort.common.pojo.PageResult;
+import com.reelshort.framework.log.OperationLogEntry;
+import com.reelshort.framework.log.OperationLogSink;
+import com.reelshort.system.dal.entity.OperationLog;
+import com.reelshort.system.dal.mapper.OperationLogMapper;
+import com.reelshort.system.vo.OperationLogPageReqVO;
+import com.reelshort.system.vo.OperationLogRespVO;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+import org.springframework.util.StringUtils;
+
+import java.util.List;
+
+/**
+ * 操作日志：由 {@code @OperationLog} 切面自动写入，后台只读查询。
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class OperationLogService implements OperationLogSink {
+
+    private final OperationLogMapper operationLogMapper;
+
+    @Override
+    public void save(OperationLogEntry entry) {
+        OperationLog entity = new OperationLog();
+        entity.setAdminUserId(entry.getUserId() == null ? 0L : entry.getUserId());
+        entity.setUsername(entry.getUsername() == null ? "" : entry.getUsername());
+        entity.setModule(entry.getModule() == null ? "" : entry.getModule());
+        entity.setAction(entry.getAction() == null ? "" : entry.getAction());
+        entity.setRequestMethod(entry.getRequestMethod() == null ? "" : entry.getRequestMethod());
+        entity.setRequestUrl(entry.getRequestUrl() == null ? "" : entry.getRequestUrl());
+        entity.setRequestParams(entry.getRequestParams());
+        entity.setRequestBody(entry.getRequestBody());
+        entity.setResponseBody(entry.getResponseBody());
+        entity.setStatus(entry.getStatus() == null ? "SUCCESS" : entry.getStatus());
+        entity.setErrorMsg(entry.getErrorMsg() == null ? "" : entry.getErrorMsg());
+        entity.setDurationMs(entry.getDurationMs() == null ? 0 : entry.getDurationMs());
+        entity.setIp(entry.getIp() == null ? "" : entry.getIp());
+        operationLogMapper.insert(entity);
+    }
+
+    public PageResult<OperationLogRespVO> page(OperationLogPageReqVO req) {
+        Page<OperationLog> page = new Page<>(req.getSafePageIndex(), req.getSafePageSize());
+        IPage<OperationLog> result = operationLogMapper.selectPage(page,
+                Wrappers.<OperationLog>lambdaQuery()
+                        .like(StringUtils.hasText(req.getUsername()), OperationLog::getUsername, req.getUsername())
+                        .eq(StringUtils.hasText(req.getModule()), OperationLog::getModule, req.getModule())
+                        .like(StringUtils.hasText(req.getAction()), OperationLog::getAction, req.getAction())
+                        .eq(StringUtils.hasText(req.getStatus()), OperationLog::getStatus, req.getStatus())
+                        .ge(req.getStartTime() != null, OperationLog::getCreatedAt, req.getStartTime())
+                        .le(req.getEndTime() != null, OperationLog::getCreatedAt, req.getEndTime())
+                        .orderByDesc(OperationLog::getId));
+        return new PageResult<>(result.getTotal(), toRespList(result.getRecords()));
+    }
+
+    public OperationLogRespVO get(Long id) {
+        OperationLog entity = id == null ? null : operationLogMapper.selectById(id);
+        if (entity == null) {
+            throw new ServiceException(ErrorCode.DATA_NOT_FOUND, "操作日志不存在");
+        }
+        return toRespList(List.of(entity)).get(0);
+    }
+
+    private List<OperationLogRespVO> toRespList(List<OperationLog> logs) {
+        return logs.stream().map(entity -> {
+            OperationLogRespVO vo = new OperationLogRespVO();
+            vo.setId(entity.getId());
+            vo.setUserId(entity.getAdminUserId());
+            vo.setUsername(entity.getUsername());
+            vo.setModule(entity.getModule());
+            vo.setAction(entity.getAction());
+            vo.setRequestMethod(entity.getRequestMethod());
+            vo.setRequestUrl(entity.getRequestUrl());
+            vo.setRequestParams(entity.getRequestParams());
+            vo.setRequestBody(entity.getRequestBody());
+            vo.setResponseBody(entity.getResponseBody());
+            vo.setStatus(entity.getStatus());
+            vo.setStatusText("SUCCESS".equals(entity.getStatus()) ? "成功" : "失败");
+            vo.setErrorMsg(entity.getErrorMsg());
+            vo.setDurationMs(entity.getDurationMs());
+            vo.setIp(entity.getIp());
+            vo.setCreatedAt(entity.getCreatedAt());
+            return vo;
+        }).toList();
+    }
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/service/PermissionService.java b/reelshort-module-system/src/main/java/com/reelshort/system/service/PermissionService.java
new file mode 100644
index 0000000..a911aca
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/service/PermissionService.java
@@ -0,0 +1,62 @@
+package com.reelshort.system.service;
+
+import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import com.reelshort.system.dal.entity.Permission;
+import com.reelshort.system.dal.mapper.PermissionMapper;
+import com.reelshort.system.vo.PermissionGroupVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * 权限点主数据。
+ */
+@Service
+@RequiredArgsConstructor
+public class PermissionService {
+
+    private final PermissionMapper permissionMapper;
+
+    public List<Permission> listAll() {
+        return permissionMapper.selectList(
+                Wrappers.<Permission>lambdaQuery().orderByAsc(Permission::getSort));
+    }
+
+    public List<PermissionGroupVO> listGroups() {
+        Map<String, List<PermissionGroupVO.Item>> grouped = new LinkedHashMap<>();
+        for (Permission permission : listAll()) {
+            grouped.computeIfAbsent(permission.getGroupName(), key -> new ArrayList<>())
+                    .add(new PermissionGroupVO.Item(permission.getCode(), permission.getName()));
+        }
+        return grouped.entrySet().stream()
+                .map(entry -> new PermissionGroupVO(entry.getKey(), entry.getValue()))
+                .toList();
+    }
+
+    public List<Long> listIdsByCodes(List<String> codes) {
+        if (codes == null || codes.isEmpty()) {
+            return List.of();
+        }
+        List<Permission> permissions = permissionMapper.selectList(
+                Wrappers.<Permission>lambdaQuery().in(Permission::getCode, codes));
+        if (permissions.size() != codes.stream().distinct().count()) {
+            throw new ServiceException(ErrorCode.BAD_REQUEST, "存在无效的权限码");
+        }
+        return permissions.stream().map(Permission::getId).toList();
+    }
+
+    public List<String> listCodesByIds(List<Long> ids) {
+        if (ids == null || ids.isEmpty()) {
+            return List.of();
+        }
+        return permissionMapper.selectList(
+                        Wrappers.<Permission>lambdaQuery().in(Permission::getId, ids))
+                .stream().map(Permission::getCode).toList();
+    }
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/service/RoleCategoryService.java b/reelshort-module-system/src/main/java/com/reelshort/system/service/RoleCategoryService.java
new file mode 100644
index 0000000..5237971
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/service/RoleCategoryService.java
@@ -0,0 +1,90 @@
+package com.reelshort.system.service;
+
+import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import com.reelshort.system.dal.entity.Role;
+import com.reelshort.system.dal.entity.RoleCategory;
+import com.reelshort.system.dal.mapper.RoleCategoryMapper;
+import com.reelshort.system.dal.mapper.RoleMapper;
+import com.reelshort.system.vo.RoleCategoryRespVO;
+import com.reelshort.system.vo.RoleCategorySaveReqVO;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+@Service
+@RequiredArgsConstructor
+public class RoleCategoryService {
+
+    private final RoleCategoryMapper roleCategoryMapper;
+    private final RoleMapper roleMapper;
+
+    public List<RoleCategoryRespVO> list() {
+        Map<Long, Integer> counts = new HashMap<>();
+        roleMapper.selectList(null).forEach(role ->
+                counts.merge(role.getCategoryId(), 1, Integer::sum));
+        return roleCategoryMapper.selectList(
+                        Wrappers.<RoleCategory>lambdaQuery().orderByAsc(RoleCategory::getSort))
+                .stream().map(category -> {
+                    RoleCategoryRespVO vo = new RoleCategoryRespVO();
+                    vo.setId(category.getId());
+                    vo.setName(category.getName());
+                    vo.setDescription(category.getDescription());
+                    vo.setRoleCount(counts.getOrDefault(category.getId(), 0));
+                    return vo;
+                }).toList();
+    }
+
+    public Long create(RoleCategorySaveReqVO req) {
+        ensureNameAvailable(req.getName(), null);
+        RoleCategory category = new RoleCategory();
+        category.setName(req.getName());
+        category.setDescription(req.getDescription() == null ? "" : req.getDescription());
+        Long count = roleCategoryMapper.selectCount(null);
+        category.setSort((count == null ? 0 : count.intValue()) + 1);
+        roleCategoryMapper.insert(category);
+        return category.getId();
+    }
+
+    public void update(Long id, RoleCategorySaveReqVO req) {
+        RoleCategory category = getExisting(id);
+        ensureNameAvailable(req.getName(), id);
+        category.setName(req.getName());
+        if (req.getDescription() != null) {
+            category.setDescription(req.getDescription());
+        }
+        roleCategoryMapper.updateById(category);
+    }
+
+    public void delete(Long id) {
+        RoleCategory category = getExisting(id);
+        Long used = roleMapper.selectCount(
+                Wrappers.<Role>lambdaQuery().eq(Role::getCategoryId, id));
+        if (used != null && used > 0) {
+            throw new ServiceException(ErrorCode.OPERATION_NOT_ALLOWED,
+                    "分类「" + category.getName() + "」下仍有角色，无法删除");
+        }
+        roleCategoryMapper.deleteById(id);
+    }
+
+    private RoleCategory getExisting(Long id) {
+        RoleCategory category = id == null ? null : roleCategoryMapper.selectById(id);
+        if (category == null) {
+            throw new ServiceException(ErrorCode.DATA_NOT_FOUND, "角色分类不存在");
+        }
+        return category;
+    }
+
+    private void ensureNameAvailable(String name, Long excludeId) {
+        Long count = roleCategoryMapper.selectCount(Wrappers.<RoleCategory>lambdaQuery()
+                .eq(RoleCategory::getName, name)
+                .ne(excludeId != null, RoleCategory::getId, excludeId));
+        if (count != null && count > 0) {
+            throw new ServiceException(ErrorCode.DATA_EXISTS, "分类名称已存在");
+        }
+    }
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/service/RoleService.java b/reelshort-module-system/src/main/java/com/reelshort/system/service/RoleService.java
new file mode 100644
index 0000000..6b2ebae
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/service/RoleService.java
@@ -0,0 +1,236 @@
+package com.reelshort.system.service;
+
+import com.baomidou.mybatisplus.core.metadata.IPage;
+import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import com.reelshort.common.exception.ErrorCode;
+import com.reelshort.common.exception.ServiceException;
+import com.reelshort.common.pojo.PageResult;
+import com.reelshort.system.dal.entity.AdminUserRole;
+import com.reelshort.system.dal.entity.Menu;
+import com.reelshort.system.dal.entity.Role;
+import com.reelshort.system.dal.entity.RoleCategory;
+import com.reelshort.system.dal.entity.RoleMenu;
+import com.reelshort.system.dal.entity.RolePermission;
+import com.reelshort.system.dal.mapper.AdminUserRoleMapper;
+import com.reelshort.system.dal.mapper.MenuMapper;
+import com.reelshort.system.dal.mapper.RoleCategoryMapper;
+import com.reelshort.system.dal.mapper.RoleMapper;
+import com.reelshort.system.dal.mapper.RoleMenuMapper;
+import com.reelshort.system.dal.mapper.RolePermissionMapper;
+import com.reelshort.system.vo.RoleRespVO;
+import com.reelshort.system.vo.RoleSaveReqVO;
+import com.reelshort.framework.security.PermissionProvider;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.util.StringUtils;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+@Service
+@RequiredArgsConstructor
+public class RoleService implements PermissionProvider {
+
+    public static final String SUPER_ADMIN_CODE = "super_admin";
+
+    private final RoleMapper roleMapper;
+    private final RoleCategoryMapper roleCategoryMapper;
+    private final RolePermissionMapper rolePermissionMapper;
+    private final RoleMenuMapper roleMenuMapper;
+    private final AdminUserRoleMapper adminUserRoleMapper;
+    private final MenuMapper menuMapper;
+    private final PermissionService permissionService;
+
+    public PageResult<RoleRespVO> page(String keyword, Integer pageIndex, Integer pageSize) {
+        Page<Role> page = new Page<>(pageIndex == null || pageIndex < 1 ? 1 : pageIndex,
+                pageSize == null || pageSize < 1 ? 10 : pageSize);
+        IPage<Role> result = roleMapper.selectPage(page,
+                Wrappers.<Role>lambdaQuery()
+                        .like(StringUtils.hasText(keyword), Role::getName, keyword)
+                        .orderByAsc(Role::getLevel));
+        return new PageResult<>(result.getTotal(), toRespList(result.getRecords()));
+    }
+
+    public List<RoleRespVO> listAll() {
+        List<Role> roles = roleMapper.selectList(
+                Wrappers.<Role>lambdaQuery().orderByAsc(Role::getLevel));
+        return toRespList(roles);
+    }
+
+    public RoleRespVO get(Long id) {
+        Role role = getExisting(id);
+        return toRespList(List.of(role)).get(0);
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public Long create(RoleSaveReqVO req) {
+        ensureNameAvailable(req.getName(), null);
+        Role role = new Role();
+        role.setName(req.getName());
+        role.setCode(StringUtils.hasText(req.getCode()) ? req.getCode() : req.getName());
+        role.setCategoryId(req.getCategoryId() == null ? 0L : req.getCategoryId());
+        role.setLevel(req.getLevel() == null ? 9 : req.getLevel());
+        role.setDescription(req.getDescription() == null ? "" : req.getDescription());
+        role.setStatus(req.getStatus() == null ? 1 : req.getStatus());
+        role.setIsBuiltin(0);
+        roleMapper.insert(role);
+        if (req.getPermissions() != null) {
+            replacePermissions(role.getId(), req.getPermissions());
+        }
+        return role.getId();
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public void update(Long id, RoleSaveReqVO req) {
+        Role role = getExisting(id);
+        ensureNameAvailable(req.getName(), id);
+        role.setName(req.getName());
+        if (StringUtils.hasText(req.getCode()) && !SUPER_ADMIN_CODE.equals(role.getCode())) {
+            role.setCode(req.getCode());
+        }
+        if (req.getCategoryId() != null) {
+            role.setCategoryId(req.getCategoryId());
+        }
+        if (req.getLevel() != null) {
+            role.setLevel(req.getLevel());
+        }
+        if (req.getDescription() != null) {
+            role.setDescription(req.getDescription());
+        }
+        if (req.getStatus() != null && role.getIsBuiltin() != 1) {
+            role.setStatus(req.getStatus());
+        }
+        roleMapper.updateById(role);
+        if (req.getPermissions() != null) {
+            replacePermissions(id, req.getPermissions());
+        }
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public void delete(Long id) {
+        Role role = getExisting(id);
+        if (role.getIsBuiltin() == 1) {
+            throw new ServiceException(ErrorCode.OPERATION_NOT_ALLOWED, "内置角色不可删除");
+        }
+        roleMapper.deleteById(id);
+        rolePermissionMapper.delete(Wrappers.<RolePermission>lambdaQuery().eq(RolePermission::getRoleId, id));
+        roleMenuMapper.delete(Wrappers.<RoleMenu>lambdaQuery().eq(RoleMenu::getRoleId, id));
+    }
+
+    @Transactional(rollbackFor = Exception.class)
+    public void updatePermissions(Long roleId, List<String> codes) {
+        getExisting(roleId);
+        replacePermissions(roleId, codes);
+    }
+
+    public List<String> listCodesByRoleId(Long roleId) {
+        List<RolePermission> links = rolePermissionMapper.selectList(
+                Wrappers.<RolePermission>lambdaQuery().eq(RolePermission::getRoleId, roleId));
+        return permissionService.listCodesByIds(links.stream().map(RolePermission::getPermissionId).toList());
+    }
+
+    public List<String> listCodesByUserId(Long userId) {
+        List<Long> roleIds = listRoleIdsByUserId(userId);
+        if (roleIds.isEmpty()) {
+            return List.of();
+        }
+        List<RolePermission> links = rolePermissionMapper.selectList(
+                Wrappers.<RolePermission>lambdaQuery().in(RolePermission::getRoleId, roleIds));
+        return permissionService.listCodesByIds(
+                links.stream().map(RolePermission::getPermissionId).distinct().toList());
+    }
+
+    /** 供框架层实时判断权限使用：角色的权限改了立即生效，不需要重新登录。 */
+    @Override
+    public List<String> listPermissionsByUserId(Long userId) {
+        return listCodesByUserId(userId);
+    }
+
+    public List<Long> listRoleIdsByUserId(Long userId) {
+        return adminUserRoleMapper.selectList(
+                        Wrappers.<AdminUserRole>lambdaQuery().eq(AdminUserRole::getUserId, userId))
+                .stream().map(AdminUserRole::getRoleId).toList();
+    }
+
+    public Role getRoleOfUser(Long userId) {
+        List<Long> roleIds = listRoleIdsByUserId(userId);
+        if (roleIds.isEmpty()) {
+            return null;
+        }
+        return roleMapper.selectById(roleIds.get(0));
+    }
+
+    public Role getExisting(Long id) {
+        Role role = id == null ? null : roleMapper.selectById(id);
+        if (role == null) {
+            throw new ServiceException(ErrorCode.DATA_NOT_FOUND, "角色不存在");
+        }
+        return role;
+    }
+
+    /** 权限变化时同步角色可访问的菜单，菜单树由权限码派生。 */
+    private void replacePermissions(Long roleId, List<String> codes) {
+        List<Long> permissionIds = permissionService.listIdsByCodes(codes);
+        rolePermissionMapper.delete(Wrappers.<RolePermission>lambdaQuery().eq(RolePermission::getRoleId, roleId));
+        permissionIds.forEach(permissionId -> rolePermissionMapper.insert(new RolePermission(roleId, permissionId)));
+
+        List<Long> menuIds = codes == null || codes.isEmpty() ? List.of()
+                : menuMapper.selectList(Wrappers.<Menu>lambdaQuery().in(Menu::getPermissionCode, codes))
+                        .stream().map(Menu::getId).toList();
+        roleMenuMapper.delete(Wrappers.<RoleMenu>lambdaQuery().eq(RoleMenu::getRoleId, roleId));
+        menuIds.forEach(menuId -> roleMenuMapper.insert(new RoleMenu(roleId, menuId)));
+    }
+
+    private void ensureNameAvailable(String name, Long excludeId) {
+        Long count = roleMapper.selectCount(Wrappers.<Role>lambdaQuery()
+                .eq(Role::getName, name)
+                .ne(excludeId != null, Role::getId, excludeId));
+        if (count != null && count > 0) {
+            throw new ServiceException(ErrorCode.DATA_EXISTS, "角色名称已存在");
+        }
+    }
+
+    private List<RoleRespVO> toRespList(List<Role> roles) {
+        if (roles.isEmpty()) {
+            return List.of();
+        }
+        Map<Long, String> categoryNames = roleCategoryMapper.selectList(null).stream()
+                .collect(Collectors.toMap(RoleCategory::getId, RoleCategory::getName, (a, b) -> a));
+        Map<Long, Integer> memberCounts = new HashMap<>();
+        adminUserRoleMapper.selectList(null)
+                .forEach(link -> memberCounts.merge(link.getRoleId(), 1, Integer::sum));
+
+        Map<Long, List<String>> permissionCache = new HashMap<>();
+        return roles.stream().map(role -> {
+            RoleRespVO vo = new RoleRespVO();
+            vo.setId(role.getId());
+            vo.setName(role.getName());
+            vo.setCode(role.getCode());
+            vo.setDescription(role.getDescription());
+            vo.setCategoryId(role.getCategoryId());
+            vo.setCategory(categoryNames.getOrDefault(role.getCategoryId(), ""));
+            vo.setLevel(role.getLevel());
+            vo.setStatus(role.getStatus());
+            vo.setStatusText(role.getStatus() != null && role.getStatus() == 1 ? "启用" : "停用");
+            vo.setBuiltin(role.getIsBuiltin() != null && role.getIsBuiltin() == 1);
+            vo.setMemberCount(memberCounts.getOrDefault(role.getId(), 0));
+            vo.setPermissions(permissionCache.computeIfAbsent(role.getId(), this::listCodesByRoleId));
+            return vo;
+        }).toList();
+    }
+
+    public Map<Long, String> roleNameMap() {
+        return roleMapper.selectList(null).stream()
+                .collect(Collectors.toMap(Role::getId, Role::getName, (a, b) -> a));
+    }
+
+    public Function<Long, String> roleNameResolver() {
+        Map<Long, String> names = roleNameMap();
+        return id -> names.getOrDefault(id, "");
+    }
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/AdminUserPageReqVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/AdminUserPageReqVO.java
new file mode 100644
index 0000000..706e1cb
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/AdminUserPageReqVO.java
@@ -0,0 +1,14 @@
+package com.reelshort.system.vo;
+
+import com.reelshort.common.pojo.PageParam;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class AdminUserPageReqVO extends PageParam {
+
+    private String username;
+    private Long roleId;
+    private Integer status;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/AdminUserRespVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/AdminUserRespVO.java
new file mode 100644
index 0000000..13c1432
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/AdminUserRespVO.java
@@ -0,0 +1,27 @@
+package com.reelshort.system.vo;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+public class AdminUserRespVO {
+
+    private Long id;
+    private String username;
+    private String name;
+    private Long roleId;
+    private String role;
+    private String ipWhitelist;
+    private Integer status;
+    private String statusText;
+    private Integer twoFactor;
+    private String twoFactorText;
+
+    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    private LocalDateTime createdAt;
+
+    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    private LocalDateTime lastLogin;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/AdminUserSaveReqVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/AdminUserSaveReqVO.java
new file mode 100644
index 0000000..0cc715a
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/AdminUserSaveReqVO.java
@@ -0,0 +1,24 @@
+package com.reelshort.system.vo;
+
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.NotNull;
+import lombok.Data;
+
+@Data
+public class AdminUserSaveReqVO {
+
+    /** 新增时必填，编辑时忽略 */
+    private String username;
+
+    private String password;
+
+    @NotBlank(message = "请输入姓名")
+    private String name;
+
+    @NotNull(message = "请选择角色")
+    private Long roleId;
+
+    private String ipWhitelist;
+    private Integer status;
+    private Integer twoFactor;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/ConfigItemVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/ConfigItemVO.java
new file mode 100644
index 0000000..aa00e7a
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/ConfigItemVO.java
@@ -0,0 +1,13 @@
+package com.reelshort.system.vo;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+
+@Data
+@AllArgsConstructor
+public class ConfigItemVO {
+
+    private String key;
+    private String value;
+    private String remark;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/LoginReqVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/LoginReqVO.java
new file mode 100644
index 0000000..7145159
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/LoginReqVO.java
@@ -0,0 +1,14 @@
+package com.reelshort.system.vo;
+
+import jakarta.validation.constraints.NotBlank;
+import lombok.Data;
+
+@Data
+public class LoginReqVO {
+
+    @NotBlank(message = "请输入账号")
+    private String username;
+
+    @NotBlank(message = "请输入密码")
+    private String password;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/LoginRespVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/LoginRespVO.java
new file mode 100644
index 0000000..42d866e
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/LoginRespVO.java
@@ -0,0 +1,22 @@
+package com.reelshort.system.vo;
+
+import lombok.Builder;
+import lombok.Data;
+
+import java.util.List;
+
+@Data
+@Builder
+public class LoginRespVO {
+
+    private String token;
+    private Long userId;
+    private String username;
+    private String name;
+    private String avatar;
+    /** 角色编码，如 super_admin */
+    private String role;
+    private String roleName;
+    private Long roleId;
+    private List<String> permissions;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/MenuSaveReqVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/MenuSaveReqVO.java
new file mode 100644
index 0000000..b61ffe8
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/MenuSaveReqVO.java
@@ -0,0 +1,24 @@
+package com.reelshort.system.vo;
+
+import jakarta.validation.constraints.NotBlank;
+import lombok.Data;
+
+@Data
+public class MenuSaveReqVO {
+
+    private Long parentId;
+
+    @NotBlank(message = "请输入菜单名称")
+    private String title;
+
+    private String routePath;
+    private String routeName;
+    private String component;
+    private String redirect;
+    private String icon;
+    private String permissionCode;
+    private String type;
+    private Integer sort;
+    private Integer visible;
+    private Integer status;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/MenuVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/MenuVO.java
new file mode 100644
index 0000000..cfb8313
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/MenuVO.java
@@ -0,0 +1,40 @@
+package com.reelshort.system.vo;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import lombok.AllArgsConstructor;
+import lombok.Data;
+
+import java.util.List;
+
+/**
+ * 菜单路由树，结构必须与前端 element-plus-admin 的动态路由一致。
+ */
+@Data
+public class MenuVO {
+
+    private Long id;
+    private Long parentId;
+    private String path;
+    private String name;
+    private String component;
+    private String redirect;
+    private String icon;
+    /** CATALOG / MENU / BUTTON */
+    private String type;
+    private String permissionCode;
+    private Integer sort;
+    private Integer visible;
+    private Integer status;
+    private Meta meta;
+    private List<MenuVO> children;
+
+    @Data
+    @AllArgsConstructor
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static class Meta {
+        private String title;
+        private String icon;
+        private Boolean alwaysShow;
+        private Boolean affix;
+    }
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/OperationLogPageReqVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/OperationLogPageReqVO.java
new file mode 100644
index 0000000..0be9f17
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/OperationLogPageReqVO.java
@@ -0,0 +1,28 @@
+package com.reelshort.system.vo;
+
+import com.reelshort.common.pojo.PageParam;
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+import org.springframework.format.annotation.DateTimeFormat;
+
+import java.time.LocalDateTime;
+
+@Data
+@EqualsAndHashCode(callSuper = true)
+public class OperationLogPageReqVO extends PageParam {
+
+    /** 操作人账号，模糊匹配 */
+    private String username;
+    /** 模块，精确匹配 */
+    private String module;
+    /** 动作，模糊匹配 */
+    private String action;
+    /** SUCCESS / FAIL */
+    private String status;
+
+    @DateTimeFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    private LocalDateTime startTime;
+
+    @DateTimeFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    private LocalDateTime endTime;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/OperationLogRespVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/OperationLogRespVO.java
new file mode 100644
index 0000000..1d93b3b
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/OperationLogRespVO.java
@@ -0,0 +1,29 @@
+package com.reelshort.system.vo;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+@Data
+public class OperationLogRespVO {
+
+    private Long id;
+    private Long userId;
+    private String username;
+    private String module;
+    private String action;
+    private String requestMethod;
+    private String requestUrl;
+    private String requestParams;
+    private String requestBody;
+    private String responseBody;
+    private String status;
+    private String statusText;
+    private String errorMsg;
+    private Integer durationMs;
+    private String ip;
+
+    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    private LocalDateTime createdAt;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/PasswordChangeReqVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/PasswordChangeReqVO.java
new file mode 100644
index 0000000..78074bf
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/PasswordChangeReqVO.java
@@ -0,0 +1,16 @@
+package com.reelshort.system.vo;
+
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
+import lombok.Data;
+
+@Data
+public class PasswordChangeReqVO {
+
+    @NotBlank(message = "请输入原密码")
+    private String oldPassword;
+
+    @NotBlank(message = "请输入新密码")
+    @Size(min = 6, max = 32, message = "新密码长度需在 6-32 位之间")
+    private String newPassword;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/PermissionGroupVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/PermissionGroupVO.java
new file mode 100644
index 0000000..0b10a33
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/PermissionGroupVO.java
@@ -0,0 +1,21 @@
+package com.reelshort.system.vo;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+
+import java.util.List;
+
+@Data
+@AllArgsConstructor
+public class PermissionGroupVO {
+
+    private String name;
+    private List<Item> items;
+
+    @Data
+    @AllArgsConstructor
+    public static class Item {
+        private String code;
+        private String name;
+    }
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/ProfileRespVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/ProfileRespVO.java
new file mode 100644
index 0000000..7bb32b4
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/ProfileRespVO.java
@@ -0,0 +1,24 @@
+package com.reelshort.system.vo;
+
+import lombok.Builder;
+import lombok.Data;
+
+import java.util.List;
+
+/**
+ * 当前登录人信息，字段与登录返回保持一致，便于前端直接覆盖本地缓存的用户信息。
+ */
+@Data
+@Builder
+public class ProfileRespVO {
+
+    private Long userId;
+    private String username;
+    private String name;
+    private String avatar;
+    /** 角色编码，如 super_admin */
+    private String role;
+    private String roleName;
+    private Long roleId;
+    private List<String> permissions;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/RoleCategoryRespVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/RoleCategoryRespVO.java
new file mode 100644
index 0000000..d54980d
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/RoleCategoryRespVO.java
@@ -0,0 +1,12 @@
+package com.reelshort.system.vo;
+
+import lombok.Data;
+
+@Data
+public class RoleCategoryRespVO {
+
+    private Long id;
+    private String name;
+    private String description;
+    private Integer roleCount;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/RoleCategorySaveReqVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/RoleCategorySaveReqVO.java
new file mode 100644
index 0000000..8265854
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/RoleCategorySaveReqVO.java
@@ -0,0 +1,13 @@
+package com.reelshort.system.vo;
+
+import jakarta.validation.constraints.NotBlank;
+import lombok.Data;
+
+@Data
+public class RoleCategorySaveReqVO {
+
+    @NotBlank(message = "请输入分类名称")
+    private String name;
+
+    private String description;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/RolePermissionSaveReqVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/RolePermissionSaveReqVO.java
new file mode 100644
index 0000000..09bd631
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/RolePermissionSaveReqVO.java
@@ -0,0 +1,13 @@
+package com.reelshort.system.vo;
+
+import jakarta.validation.constraints.NotNull;
+import lombok.Data;
+
+import java.util.List;
+
+@Data
+public class RolePermissionSaveReqVO {
+
+    @NotNull(message = "权限不能为空")
+    private List<String> permissions;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/RoleRespVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/RoleRespVO.java
new file mode 100644
index 0000000..4f9adf1
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/RoleRespVO.java
@@ -0,0 +1,22 @@
+package com.reelshort.system.vo;
+
+import lombok.Data;
+
+import java.util.List;
+
+@Data
+public class RoleRespVO {
+
+    private Long id;
+    private String name;
+    private String code;
+    private String description;
+    private Long categoryId;
+    private String category;
+    private Integer level;
+    private Integer status;
+    private String statusText;
+    private Boolean builtin;
+    private Integer memberCount;
+    private List<String> permissions;
+}
diff --git a/reelshort-module-system/src/main/java/com/reelshort/system/vo/RoleSaveReqVO.java b/reelshort-module-system/src/main/java/com/reelshort/system/vo/RoleSaveReqVO.java
new file mode 100644
index 0000000..6fece8e
--- /dev/null
+++ b/reelshort-module-system/src/main/java/com/reelshort/system/vo/RoleSaveReqVO.java
@@ -0,0 +1,24 @@
+package com.reelshort.system.vo;
+
+import jakarta.validation.constraints.NotBlank;
+import lombok.Data;
+
+import java.util.List;
+
+@Data
+public class RoleSaveReqVO {
+
+    @NotBlank(message = "请输入角色名称")
+    private String name;
+
+    /** 不传时按名称生成 */
+    private String code;
+
+    private String description;
+    private Long categoryId;
+    private Integer level;
+    private Integer status;
+
+    /** 角色权限码，传则整体覆盖 */
+    private List<String> permissions;
+}
diff --git a/sql/data.sql b/sql/data.sql
new file mode 100644
index 0000000..c877c50
--- /dev/null
+++ b/sql/data.sql
@@ -0,0 +1,191 @@
+-- ReelShort 短剧服务 · 初始化数据（PostgreSQL 18，可重复执行）
+-- 演示账号：admin / admin123（其余种子账号密码相同）
+--
+-- MySQL 的 ON DUPLICATE KEY UPDATE 在这里换成 ON CONFLICT (id) DO UPDATE；
+-- INSERT IGNORE 换成 ON CONFLICT DO NOTHING。
+-- 末尾会把自增序列对齐到已有最大 ID，避免后续插入主键冲突。
+
+-- ---------- 角色分类 ----------
+INSERT INTO sys_role_category (id, name, description, sort) VALUES
+  (1, '系统管理员', '负责账号、权限和菜单配置', 1),
+  (2, '内容管理',   '负责短剧与剧集内容维护',   2),
+  (3, '数据分析',   '负责查看运营数据',         3)
+ON CONFLICT (id) DO UPDATE SET name = EXCLUDED.name, description = EXCLUDED.description, sort = EXCLUDED.sort;
+
+-- ---------- 角色 ----------
+INSERT INTO sys_role (id, name, code, category_id, level, description, status, is_builtin) VALUES
+  (1, '超级管理员', 'super_admin',      1, 1, '拥有系统全部管理权限',       1, 1),
+  (2, '内容运营',   'content_operator', 2, 2, '管理短剧、剧集及封面素材',   1, 1),
+  (3, '审核专员',   'content_reviewer', 2, 3, '审核短剧内容与发布状态',     1, 1),
+  (4, '数据分析师', 'data_analyst',     3, 4, '查看内容数据与运营报表',     1, 1)
+ON CONFLICT (id) DO UPDATE SET name = EXCLUDED.name, code = EXCLUDED.code,
+  description = EXCLUDED.description, category_id = EXCLUDED.category_id, level = EXCLUDED.level;
+
+-- ---------- 权限点 ----------
+INSERT INTO sys_permission (id, code, name, group_name, type, sort) VALUES
+  (1,  'drama:list',           '查看短剧列表',   '短剧管理', 'BUTTON', 1),
+  (2,  'drama:create',         '创建短剧',       '短剧管理', 'BUTTON', 2),
+  (3,  'drama:update',         '编辑短剧信息',   '短剧管理', 'BUTTON', 3),
+  (4,  'drama:delete',         '删除短剧',       '短剧管理', 'BUTTON', 4),
+  (5,  'episode:list',         '查看剧集列表',   '剧集管理', 'BUTTON', 5),
+  (6,  'episode:upload',       '上传剧集视频',   '剧集管理', 'BUTTON', 6),
+  (7,  'episode:sort',         '管理剧集排序',   '剧集管理', 'BUTTON', 7),
+  (8,  'cover:upload',         '上传封面素材',   '封面管理', 'BUTTON', 8),
+  (9,  'drama:review',         '审核并发布',     '审核与系统', 'BUTTON', 9),
+  (10, 'stat:view',            '查看数据报表',   '审核与系统', 'BUTTON', 10),
+  (11, 'system:role',          '角色与权限配置', '后台管理', 'BUTTON', 11),
+  (12, 'system:admin-user',    '管理员用户列表', '后台管理', 'BUTTON', 12),
+  (13, 'system:menu',          '菜单管理',       '后台管理', 'BUTTON', 13),
+  (14, 'system:role-category', '角色分类管理',   '后台管理', 'BUTTON', 14),
+  (15, 'banner:list',          '查看轮播图',     '运营编排', 'BUTTON', 15),
+  (16, 'banner:create',        '新建轮播图',     '运营编排', 'BUTTON', 16),
+  (17, 'banner:update',        '编辑轮播图',     '运营编排', 'BUTTON', 17),
+  (18, 'banner:delete',        '删除轮播图',     '运营编排', 'BUTTON', 18),
+  (19, 'log:list',             '查看操作日志',   '后台管理', 'BUTTON', 19)
+ON CONFLICT (id) DO UPDATE SET code = EXCLUDED.code, name = EXCLUDED.name,
+  group_name = EXCLUDED.group_name, sort = EXCLUDED.sort;
+
+-- ---------- 菜单 ----------
+INSERT INTO sys_menu (id, parent_id, title, route_path, route_name, component, redirect, icon,
+                      permission_code, type, always_show, affix, sort) VALUES
+  (1,  0, '工作台',        '/dashboard', 'Dashboard',   '#',                                            '/dashboard/index', 'ant-design:dashboard-filled', 'drama:list',       'CATALOG', 0, 0, 1),
+  (2,  1, '工作台',        'index',      'dashboard',   'views/common/DashboardView',                   '',                 'ant-design:dashboard-filled', 'drama:list',       'MENU',    0, 1, 1),
+  (3,  0, '内容管理',      '/content',   'Content',     '#',                                            '/content/dramas',  'ep:video-camera',             'drama:list',       'CATALOG', 1, 0, 2),
+  (4,  3, '短剧管理',      'dramas',     'dramas',      'views/contentManagement/DramaManagementView',   '',                 '',                            'drama:list',       'MENU',    0, 0, 1),
+  (5,  3, '剧集管理',      'episodes',   'episodes',    'views/contentManagement/EpisodeManagementView', '',                 '',                            'episode:list',     'MENU',    0, 0, 2),
+  (12, 3, '轮播图管理',    'banners',    'banners',     'views/contentManagement/BannerManagementView',  '',                 '',                            'banner:list',      'MENU',    0, 0, 3),
+  (13, 3, '类型管理',      'categories', 'categories',  'views/contentManagement/CategoryManagementView','',                 '',                            'drama:list',       'MENU',    0, 0, 4),
+  (6,  0, '后台管理',      '/system',    'System',      '#',                                            '/system/access',   'ep:setting',                  'system:role',      'CATALOG', 1, 0, 3),
+  (7,  6, '角色权限配置',  'access',     'access',      'views/permission/RoleManagementView',           '',                 '',                            'system:role',      'MENU',    0, 0, 1),
+  (8,  6, '管理员用户列表','admin-users','admin-users', 'views/userManagement/AdminUsersView',           '',                 '',                            'system:admin-user','MENU',    0, 0, 2),
+  (9,  6, '菜单管理',      'menus',      'menus',       'views/permission/MenuManagementView',           '',                 '',                            'system:menu',      'MENU',    0, 0, 3),
+  (10, 6, '角色分类',      'role-categories','role-categories','views/permission/RoleCategoriesView',   '',                 '',                            'system:role-category','MENU', 0, 0, 4),
+  (11, 6, '系统设置',      'settings',   'settings',    'views/systemManagement/SettingsView',           '',                 '',                            'system:role',      'MENU',    0, 0, 5)
+ON CONFLICT (id) DO UPDATE SET parent_id = EXCLUDED.parent_id, title = EXCLUDED.title,
+  route_path = EXCLUDED.route_path, route_name = EXCLUDED.route_name, component = EXCLUDED.component,
+  redirect = EXCLUDED.redirect, icon = EXCLUDED.icon, permission_code = EXCLUDED.permission_code,
+  type = EXCLUDED.type, always_show = EXCLUDED.always_show, affix = EXCLUDED.affix, sort = EXCLUDED.sort;
+
+-- 操作日志菜单（挂在后台管理下，仅超级管理员可见）
+INSERT INTO sys_menu (id, parent_id, title, route_path, route_name, component, redirect, icon,
+                      permission_code, type, always_show, affix, sort) VALUES
+  (14, 6, '操作日志', 'operation-logs', 'operation-logs', 'views/systemManagement/OperationLogView', '', '', 'log:list', 'MENU', 0, 0, 6)
+ON CONFLICT (id) DO UPDATE SET parent_id = EXCLUDED.parent_id, title = EXCLUDED.title,
+  route_path = EXCLUDED.route_path, route_name = EXCLUDED.route_name, component = EXCLUDED.component,
+  redirect = EXCLUDED.redirect, icon = EXCLUDED.icon, permission_code = EXCLUDED.permission_code,
+  type = EXCLUDED.type, always_show = EXCLUDED.always_show, affix = EXCLUDED.affix, sort = EXCLUDED.sort;
+
+-- ---------- 角色-权限 ----------
+INSERT INTO sys_role_permission (role_id, permission_id)
+SELECT r.id, p.id FROM sys_role r CROSS JOIN sys_permission p WHERE r.code = 'super_admin'
+ON CONFLICT DO NOTHING;
+
+INSERT INTO sys_role_permission (role_id, permission_id)
+SELECT r.id, p.id FROM sys_role r CROSS JOIN sys_permission p
+WHERE r.code = 'content_operator'
+  AND p.code IN ('drama:list','drama:create','drama:update','drama:delete',
+                 'episode:list','episode:upload','episode:sort','cover:upload',
+                 'banner:list','banner:create','banner:update','banner:delete')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO sys_role_permission (role_id, permission_id)
+SELECT r.id, p.id FROM sys_role r CROSS JOIN sys_permission p
+WHERE r.code = 'content_reviewer'
+  AND p.code IN ('drama:list','episode:list','drama:review','stat:view','banner:list')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO sys_role_permission (role_id, permission_id)
+SELECT r.id, p.id FROM sys_role r CROSS JOIN sys_permission p
+WHERE r.code = 'data_analyst'
+  AND p.code IN ('drama:list','stat:view','banner:list')
+ON CONFLICT DO NOTHING;
+
+-- ---------- 角色-菜单 ----------
+INSERT INTO sys_role_menu (role_id, menu_id)
+SELECT r.id, m.id FROM sys_role r CROSS JOIN sys_menu m WHERE r.code = 'super_admin'
+ON CONFLICT DO NOTHING;
+
+INSERT INTO sys_role_menu (role_id, menu_id)
+SELECT r.id, m.id FROM sys_role r CROSS JOIN sys_menu m
+WHERE r.code IN ('content_operator','content_reviewer','data_analyst') AND m.id IN (1,2,3,4,5,12,13)
+ON CONFLICT DO NOTHING;
+
+-- ---------- 管理员（密码均为 admin123） ----------
+INSERT INTO sys_admin_user (id, username, password, real_name, mobile, email, status, ip_whitelist,
+                            two_factor, last_login_at, created_at) VALUES
+  (1001, 'admin',              '$2a$10$cknSDsmYgEADwwv0HdwzUOPqiz8D6mO/OOWMm3QEx.zmJW4iQqLcq', '系统管理员', '', '', 1, '', 0, NULL, '2026-09-01 09:00:00'),
+  (1002, 'lin.xiaoman',        '$2a$10$cknSDsmYgEADwwv0HdwzUOPqiz8D6mO/OOWMm3QEx.zmJW4iQqLcq', '林小满',   '', '', 1, '', 1, '2026-10-12 09:41:22', '2026-09-18 09:30:00'),
+  (1003, 'content.editor01',   '$2a$10$cknSDsmYgEADwwv0HdwzUOPqiz8D6mO/OOWMm3QEx.zmJW4iQqLcq', '陈一诺',   '', '', 1, '', 0, '2026-10-11 16:20:15', '2026-09-21 10:15:00'),
+  (1004, 'content.editor02',   '$2a$10$cknSDsmYgEADwwv0HdwzUOPqiz8D6mO/OOWMm3QEx.zmJW4iQqLcq', '周子瑜',   '', '', 1, '', 0, '2026-10-11 13:34:10', '2026-09-25 14:20:00'),
+  (1005, 'content.reviewer01', '$2a$10$cknSDsmYgEADwwv0HdwzUOPqiz8D6mO/OOWMm3QEx.zmJW4iQqLcq', '林晓彤',   '', '', 1, '', 1, '2026-10-10 11:20:08', '2026-10-02 11:05:00'),
+  (1006, 'data.analyst01',     '$2a$10$cknSDsmYgEADwwv0HdwzUOPqiz8D6mO/OOWMm3QEx.zmJW4iQqLcq', '程予安',   '', '', 1, '', 0, '2026-10-09 14:10:02', '2026-10-05 13:02:00')
+ON CONFLICT (id) DO UPDATE SET username = EXCLUDED.username, real_name = EXCLUDED.real_name,
+  status = EXCLUDED.status, two_factor = EXCLUDED.two_factor, last_login_at = EXCLUDED.last_login_at;
+
+INSERT INTO sys_admin_user_role (user_id, role_id) VALUES
+  (1001, 1), (1002, 1), (1003, 2), (1004, 2), (1005, 3), (1006, 4)
+ON CONFLICT DO NOTHING;
+
+-- ---------- 系统配置 ----------
+INSERT INTO sys_config (config_key, config_value, remark) VALUES
+  ('workspace.name', 'ReelShort Studio', '工作空间名称'),
+  ('content.default-status', 'draft', '内容默认状态')
+ON CONFLICT (config_key) DO UPDATE SET config_value = EXCLUDED.config_value, remark = EXCLUDED.remark;
+
+-- ---------- 短剧类型 ----------
+INSERT INTO drama_category (id, name, sort, status) VALUES
+  (1, '都市情感', 1, 1),
+  (2, '重生逆袭', 2, 1),
+  (3, '甜宠爱情', 3, 1),
+  (4, '悬疑复仇', 4, 1)
+ON CONFLICT (id) DO UPDATE SET name = EXCLUDED.name, sort = EXCLUDED.sort, status = EXCLUDED.status;
+
+-- ---------- 短剧 ----------
+INSERT INTO drama (id, code, title, category_id, genre, synopsis, total_episodes, free_episodes,
+                   unlock_coin, is_hot, status, published_at, view_count, sort, created_at) VALUES
+  (1, 'D20250612001', '替嫁新娘：总裁的掌心宠', 1, '都市情感',
+   '一场意外替嫁，让她成为冷面总裁的契约新娘。', 68, 3, 60, 1, 'published', '2025-06-12 10:00:00', 2400000, 1, '2025-06-01 09:00:00'),
+  (2, 'D20250618002', '重生之我在豪门当千金', 2, '重生逆袭',
+   '重活一世，她要拿回属于自己的一切。', 42, 3, 60, 0, 'reviewing', NULL, 0, 2, '2025-06-05 09:00:00'),
+  (3, 'D20250529003', '心动信号：请和我恋爱', 3, '甜宠爱情',
+   '恋爱观察室里，心动正在悄悄发生。', 56, 3, 50, 0, 'published', '2025-05-29 10:00:00', 1800000, 3, '2025-05-20 09:00:00'),
+  (4, 'D20250620004', '她从深渊中走来', 4, '悬疑复仇',
+   '真相只有一个，而她亲手揭开迷雾。', 24, 3, 80, 0, 'draft', NULL, 0, 4, '2025-06-15 09:00:00'),
+  (5, 'D20250521005', '闪婚后，傅先生每天都在撒糖', 1, '都市情感',
+   '一纸婚约，开启了甜蜜又心动的同居生活。', 72, 3, 60, 1, 'published', '2025-05-21 10:00:00', 3100000, 5, '2025-05-10 09:00:00')
+ON CONFLICT (id) DO UPDATE SET code = EXCLUDED.code, title = EXCLUDED.title, genre = EXCLUDED.genre,
+  synopsis = EXCLUDED.synopsis, category_id = EXCLUDED.category_id, status = EXCLUDED.status,
+  total_episodes = EXCLUDED.total_episodes, free_episodes = EXCLUDED.free_episodes,
+  unlock_coin = EXCLUDED.unlock_coin, is_hot = EXCLUDED.is_hot, view_count = EXCLUDED.view_count;
+
+-- ---------- 剧集（示例：短剧 1） ----------
+INSERT INTO drama_episode (id, drama_id, ep_no, title, duration_sec, is_free, unlock_coin, status, play_count) VALUES
+  (1, 1, 1, '命运的相遇', 138, 1, 0,  'published', 48201),
+  (2, 1, 2, '意外的婚约', 116, 1, 0,  'published', 42817),
+  (3, 1, 3, '心动的开始', 124, 1, 0,  'published', 39506),
+  (4, 1, 4, '他的秘密',   151, 0, 60, 'draft',     0)
+ON CONFLICT (id) DO UPDATE SET drama_id = EXCLUDED.drama_id, ep_no = EXCLUDED.ep_no,
+  title = EXCLUDED.title, duration_sec = EXCLUDED.duration_sec, is_free = EXCLUDED.is_free,
+  unlock_coin = EXCLUDED.unlock_coin, status = EXCLUDED.status, play_count = EXCLUDED.play_count;
+
+-- ---------- 对齐自增序列 ----------
+-- 上面用了显式 ID，但 IDENTITY 序列不会因此前移；不对齐的话，后续插入会从 1 开始而撞主键。
+DO $$
+DECLARE
+  t text;
+  seq text;
+  maxid bigint;
+BEGIN
+  FOREACH t IN ARRAY ARRAY[
+    'sys_admin_user','sys_role_category','sys_role','sys_admin_user_role','sys_permission',
+    'sys_menu','sys_role_permission','sys_role_menu','sys_config','sys_operation_log',
+    'drama_category','drama','drama_episode','drama_review_record','content_banner',
+    'media_asset','media_upload_task'
+  ] LOOP
+    seq := pg_get_serial_sequence(t, 'id');
+    EXECUTE format('SELECT COALESCE(MAX(id), 0) FROM %I', t) INTO maxid;
+    IF seq IS NOT NULL AND maxid > 0 THEN
+      PERFORM setval(seq, maxid);
+    END IF;
+  END LOOP;
+END $$;
diff --git a/sql/schema.sql b/sql/schema.sql
new file mode 100644
index 0000000..309d990
--- /dev/null
+++ b/sql/schema.sql
@@ -0,0 +1,320 @@
+-- ReelShort 短剧服务 · 建表脚本（PostgreSQL 18）
+--
+-- 与 MySQL 版本的对应关系：
+--   AUTO_INCREMENT        -> GENERATED BY DEFAULT AS IDENTITY
+--   TINYINT               -> SMALLINT
+--   DATETIME(3)           -> TIMESTAMP(3)
+--   ON UPDATE CURRENT_TIMESTAMP -> set_updated_at() 触发器
+--   表内 KEY / UNIQUE KEY -> 单独的 CREATE INDEX / UNIQUE 约束
+--   列注释                -> 行内注释 + 表注释（COMMENT ON TABLE）
+
+-- ========== 系统域 ==========
+
+CREATE TABLE IF NOT EXISTS sys_admin_user (
+  id            BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  username      VARCHAR(64)  NOT NULL,           -- 登录名
+  password      VARCHAR(100) NOT NULL,           -- BCrypt 哈希
+  real_name     VARCHAR(64)  NOT NULL DEFAULT '',
+  mobile        VARCHAR(20)  NOT NULL DEFAULT '',
+  email         VARCHAR(128) NOT NULL DEFAULT '',
+  avatar        VARCHAR(255) NOT NULL DEFAULT '',
+  status        SMALLINT     NOT NULL DEFAULT 1, -- 1 启用 0 停用
+  ip_whitelist  VARCHAR(255) NOT NULL DEFAULT '',-- 空 = 不限
+  two_factor    SMALLINT     NOT NULL DEFAULT 0,
+  last_login_at TIMESTAMP(3),
+  last_login_ip VARCHAR(64)  NOT NULL DEFAULT '',
+  created_at    TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at    TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  deleted       SMALLINT     NOT NULL DEFAULT 0
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_sys_admin_user_username ON sys_admin_user (username);
+COMMENT ON TABLE sys_admin_user IS '管理员';
+
+CREATE TABLE IF NOT EXISTS sys_role_category (
+  id          BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  name        VARCHAR(64)  NOT NULL,
+  description VARCHAR(255) NOT NULL DEFAULT '',
+  sort        INT          NOT NULL DEFAULT 0,
+  created_at  TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at  TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  deleted     SMALLINT     NOT NULL DEFAULT 0
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_sys_role_category_name ON sys_role_category (name);
+COMMENT ON TABLE sys_role_category IS '角色分类';
+
+CREATE TABLE IF NOT EXISTS sys_role (
+  id          BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  name        VARCHAR(64)  NOT NULL,
+  code        VARCHAR(64)  NOT NULL,             -- 如 super_admin
+  category_id BIGINT       NOT NULL DEFAULT 0,
+  level       INT          NOT NULL DEFAULT 9,   -- 越小权限越高
+  description VARCHAR(255) NOT NULL DEFAULT '',
+  status      SMALLINT     NOT NULL DEFAULT 1,
+  is_builtin  SMALLINT     NOT NULL DEFAULT 0,   -- 内置角色不可删除
+  created_at  TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at  TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  deleted     SMALLINT     NOT NULL DEFAULT 0
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_sys_role_code ON sys_role (code);
+COMMENT ON TABLE sys_role IS '角色';
+
+CREATE TABLE IF NOT EXISTS sys_admin_user_role (
+  id      BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  user_id BIGINT NOT NULL,
+  role_id BIGINT NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_sys_admin_user_role ON sys_admin_user_role (user_id, role_id);
+CREATE INDEX IF NOT EXISTS idx_sys_admin_user_role_role ON sys_admin_user_role (role_id);
+COMMENT ON TABLE sys_admin_user_role IS '管理员-角色';
+
+CREATE TABLE IF NOT EXISTS sys_permission (
+  id         BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  code       VARCHAR(128) NOT NULL,              -- 如 drama:create
+  name       VARCHAR(64)  NOT NULL,
+  group_name VARCHAR(64)  NOT NULL DEFAULT '',
+  type       VARCHAR(16)  NOT NULL DEFAULT 'BUTTON',
+  sort       INT          NOT NULL DEFAULT 0
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_sys_permission_code ON sys_permission (code);
+COMMENT ON TABLE sys_permission IS '权限点';
+
+CREATE TABLE IF NOT EXISTS sys_menu (
+  id              BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  parent_id       BIGINT       NOT NULL DEFAULT 0,
+  title           VARCHAR(64)  NOT NULL,
+  route_path      VARCHAR(128) NOT NULL DEFAULT '',
+  route_name      VARCHAR(64)  NOT NULL DEFAULT '',
+  component       VARCHAR(255) NOT NULL DEFAULT '',
+  redirect        VARCHAR(128) NOT NULL DEFAULT '',
+  icon            VARCHAR(64)  NOT NULL DEFAULT '',
+  permission_code VARCHAR(128) NOT NULL DEFAULT '',
+  type            VARCHAR(16)  NOT NULL DEFAULT 'MENU',  -- CATALOG/MENU/BUTTON
+  always_show     SMALLINT     NOT NULL DEFAULT 0,
+  affix           SMALLINT     NOT NULL DEFAULT 0,
+  sort            INT          NOT NULL DEFAULT 0,
+  visible         SMALLINT     NOT NULL DEFAULT 1,
+  status          SMALLINT     NOT NULL DEFAULT 1,
+  created_at      TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at      TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_sys_menu_parent ON sys_menu (parent_id);
+COMMENT ON TABLE sys_menu IS '菜单';
+
+CREATE TABLE IF NOT EXISTS sys_role_permission (
+  id            BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  role_id       BIGINT NOT NULL,
+  permission_id BIGINT NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_sys_role_permission ON sys_role_permission (role_id, permission_id);
+COMMENT ON TABLE sys_role_permission IS '角色-权限';
+
+CREATE TABLE IF NOT EXISTS sys_role_menu (
+  id      BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  role_id BIGINT NOT NULL,
+  menu_id BIGINT NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_sys_role_menu ON sys_role_menu (role_id, menu_id);
+COMMENT ON TABLE sys_role_menu IS '角色-菜单';
+
+CREATE TABLE IF NOT EXISTS sys_config (
+  id           BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  config_key   VARCHAR(128)  NOT NULL,
+  config_value VARCHAR(1024) NOT NULL DEFAULT '',
+  remark       VARCHAR(255)  NOT NULL DEFAULT ''
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_sys_config_key ON sys_config (config_key);
+COMMENT ON TABLE sys_config IS '系统配置';
+
+CREATE TABLE IF NOT EXISTS sys_operation_log (
+  id            BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  admin_user_id BIGINT       NOT NULL DEFAULT 0,
+  username      VARCHAR(64)  NOT NULL DEFAULT '',
+  module        VARCHAR(64)  NOT NULL DEFAULT '',
+  action        VARCHAR(64)  NOT NULL DEFAULT '',
+  request_method VARCHAR(10) NOT NULL DEFAULT '',
+  request_url    VARCHAR(512) NOT NULL DEFAULT '',
+  request_params TEXT,                            -- 查询串
+  request_body   TEXT,                            -- 请求体（已脱敏、截断）
+  response_body  TEXT,                            -- 响应体（截断）
+  status         VARCHAR(16) NOT NULL DEFAULT 'SUCCESS',  -- SUCCESS/FAIL
+  error_msg      VARCHAR(500) NOT NULL DEFAULT '',
+  duration_ms    INT         NOT NULL DEFAULT 0,
+  ip            VARCHAR(64)  NOT NULL DEFAULT '',
+  created_at    TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_sys_operation_log_admin_time ON sys_operation_log (admin_user_id, created_at);
+COMMENT ON TABLE sys_operation_log IS '操作日志';
+
+-- ========== 内容域 ==========
+
+CREATE TABLE IF NOT EXISTS drama_category (
+  id     BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  name   VARCHAR(64) NOT NULL,
+  sort   INT     NOT NULL DEFAULT 0,
+  status SMALLINT NOT NULL DEFAULT 1
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_drama_category_name ON drama_category (name);
+COMMENT ON TABLE drama_category IS '短剧类型';
+
+CREATE TABLE IF NOT EXISTS drama (
+  id                   BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  code                 VARCHAR(64)   NOT NULL DEFAULT '',
+  title                VARCHAR(128)  NOT NULL,
+  subtitle             VARCHAR(128)  NOT NULL DEFAULT '',
+  category_id          BIGINT        NOT NULL DEFAULT 0,
+  genre                VARCHAR(64)   NOT NULL DEFAULT '',
+  synopsis             VARCHAR(1000) NOT NULL DEFAULT '',
+  cover_url            VARCHAR(512)  NOT NULL DEFAULT '',
+  horizontal_cover_url VARCHAR(512)  NOT NULL DEFAULT '',
+  language             VARCHAR(16)   NOT NULL DEFAULT 'zh-CN',
+  total_episodes       INT           NOT NULL DEFAULT 0,
+  free_episodes        INT           NOT NULL DEFAULT 3,
+  unlock_coin          INT           NOT NULL DEFAULT 0,
+  is_hot               SMALLINT      NOT NULL DEFAULT 0,  -- 是否热门，供首页热门位使用
+  -- draft/reviewing/approved/published/offline
+  status               VARCHAR(16)   NOT NULL DEFAULT 'draft',
+  publish_at           TIMESTAMP(3),
+  published_at         TIMESTAMP(3),
+  view_count           BIGINT        NOT NULL DEFAULT 0,
+  play_count           BIGINT        NOT NULL DEFAULT 0,
+  favorite_count       BIGINT        NOT NULL DEFAULT 0,
+  like_count           BIGINT        NOT NULL DEFAULT 0,
+  sort                 INT           NOT NULL DEFAULT 0,
+  create_by            BIGINT        NOT NULL DEFAULT 0,
+  created_at           TIMESTAMP(3)  NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at           TIMESTAMP(3)  NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  deleted              SMALLINT      NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS idx_drama_status_publish ON drama (status, publish_at);
+CREATE INDEX IF NOT EXISTS idx_drama_category ON drama (category_id);
+CREATE INDEX IF NOT EXISTS idx_drama_updated ON drama (updated_at);
+-- C 端目录：按状态取热门 / 按分类取列表
+CREATE INDEX IF NOT EXISTS idx_drama_status_hot ON drama (status, is_hot, sort DESC);
+CREATE INDEX IF NOT EXISTS idx_drama_status_category ON drama (status, category_id, sort DESC);
+COMMENT ON TABLE drama IS '短剧';
+
+CREATE TABLE IF NOT EXISTS drama_episode (
+  id             BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  drama_id       BIGINT       NOT NULL,
+  ep_no          INT          NOT NULL,
+  title          VARCHAR(128) NOT NULL DEFAULT '',
+  duration_sec   INT          NOT NULL DEFAULT 0,
+  cover_url      VARCHAR(512) NOT NULL DEFAULT '',
+  video_asset_id BIGINT       NOT NULL DEFAULT 0,
+  video_url      VARCHAR(512) NOT NULL DEFAULT '',
+  is_free        SMALLINT     NOT NULL DEFAULT 0,
+  unlock_coin    INT          NOT NULL DEFAULT 0,
+  status         VARCHAR(16)  NOT NULL DEFAULT 'draft',
+  release_at     TIMESTAMP(3),
+  play_count     BIGINT       NOT NULL DEFAULT 0,
+  sort           INT          NOT NULL DEFAULT 0,
+  created_at     TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at     TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  deleted        SMALLINT     NOT NULL DEFAULT 0
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_drama_episode_no ON drama_episode (drama_id, ep_no);
+CREATE INDEX IF NOT EXISTS idx_drama_episode_status ON drama_episode (drama_id, status);
+COMMENT ON TABLE drama_episode IS '剧集';
+
+CREATE TABLE IF NOT EXISTS drama_review_record (
+  id            BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  biz_type      VARCHAR(16)  NOT NULL,           -- DRAMA/EPISODE
+  biz_id        BIGINT       NOT NULL,
+  action        VARCHAR(16)  NOT NULL,           -- SUBMIT/APPROVE/REJECT/PUBLISH/OFFLINE
+  reason        VARCHAR(500) NOT NULL DEFAULT '',
+  operator_id   BIGINT       NOT NULL DEFAULT 0,
+  operator_name VARCHAR(64)  NOT NULL DEFAULT '',
+  created_at    TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_drama_review_biz ON drama_review_record (biz_type, biz_id, created_at);
+COMMENT ON TABLE drama_review_record IS '审核记录';
+
+CREATE TABLE IF NOT EXISTS content_banner (
+  id         BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  image_url  VARCHAR(512) NOT NULL DEFAULT '',
+  slot       VARCHAR(32)  NOT NULL DEFAULT 'HOME_TOP',  -- 展示位置：HOME_TOP/DISCOVER
+  link_type  VARCHAR(16)  NOT NULL DEFAULT 'NONE',      -- NONE/DRAMA/URL
+  link_value VARCHAR(512) NOT NULL DEFAULT '',
+  sort       INT          NOT NULL DEFAULT 0,
+  status     SMALLINT     NOT NULL DEFAULT 1,
+  create_by  BIGINT       NOT NULL DEFAULT 0,
+  created_at TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  deleted    SMALLINT     NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS idx_content_banner_slot ON content_banner (slot, status, sort);
+COMMENT ON TABLE content_banner IS '轮播图';
+
+-- ========== 媒资域 ==========
+-- 本地存储版本：文件落在 reelshort.media.root-dir 下，通过 /files/** 访问
+
+CREATE TABLE IF NOT EXISTS media_asset (
+  id           BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  biz_type     VARCHAR(32)  NOT NULL DEFAULT 'EPISODE',
+  file_name    VARCHAR(255) NOT NULL DEFAULT '',
+  object_key   VARCHAR(512) NOT NULL DEFAULT '',
+  source_url   VARCHAR(512) NOT NULL DEFAULT '',
+  size_bytes   BIGINT       NOT NULL DEFAULT 0,
+  md5          VARCHAR(64)  NOT NULL DEFAULT '',
+  duration_sec INT          NOT NULL DEFAULT 0,
+  width        INT          NOT NULL DEFAULT 0,
+  height       INT          NOT NULL DEFAULT 0,
+  -- uploading/uploaded/transcoding/ready/failed
+  status       VARCHAR(16)  NOT NULL DEFAULT 'uploading',
+  hls_url      VARCHAR(512) NOT NULL DEFAULT '',
+  mp4_url      VARCHAR(512) NOT NULL DEFAULT '',
+  poster_url   VARCHAR(512) NOT NULL DEFAULT '',
+  create_by    BIGINT       NOT NULL DEFAULT 0,
+  created_at   TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at   TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  deleted      SMALLINT     NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS idx_media_asset_status ON media_asset (status);
+CREATE INDEX IF NOT EXISTS idx_media_asset_biz_type ON media_asset (biz_type);
+COMMENT ON TABLE media_asset IS '媒资';
+
+CREATE TABLE IF NOT EXISTS media_upload_task (
+  id              BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  upload_id       VARCHAR(64)  NOT NULL,
+  biz_type        VARCHAR(32)  NOT NULL DEFAULT 'EPISODE',
+  file_name       VARCHAR(255) NOT NULL DEFAULT '',
+  file_size       BIGINT       NOT NULL DEFAULT 0,
+  chunk_size      INT          NOT NULL DEFAULT 0,
+  total_chunks    INT          NOT NULL DEFAULT 0,
+  received_chunks INT          NOT NULL DEFAULT 0,
+  object_key      VARCHAR(512) NOT NULL DEFAULT '',
+  status          VARCHAR(16)  NOT NULL DEFAULT 'uploading',
+  asset_id        BIGINT       NOT NULL DEFAULT 0,
+  create_by       BIGINT       NOT NULL DEFAULT 0,
+  created_at      TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at      TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_media_upload_task ON media_upload_task (upload_id);
+COMMENT ON TABLE media_upload_task IS '分片上传任务';
+
+-- ========== updated_at 维护 ==========
+-- PostgreSQL 没有 ON UPDATE CURRENT_TIMESTAMP，用触发器统一维护
+
+CREATE OR REPLACE FUNCTION set_updated_at() RETURNS trigger AS $$
+BEGIN
+  NEW.updated_at = CURRENT_TIMESTAMP;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DO $$
+DECLARE
+  t text;
+BEGIN
+  FOREACH t IN ARRAY ARRAY[
+    'sys_admin_user', 'sys_role_category', 'sys_role', 'sys_menu',
+    'drama', 'drama_episode', 'content_banner', 'media_asset', 'media_upload_task'
+  ] LOOP
+    EXECUTE format('DROP TRIGGER IF EXISTS trg_%s_updated_at ON %I', t, t);
+    EXECUTE format(
+      'CREATE TRIGGER trg_%s_updated_at BEFORE UPDATE ON %I FOR EACH ROW EXECUTE FUNCTION set_updated_at()',
+      t, t
+    );
+  END LOOP;
+END;
+$$;