fix: response_code持久化到数据库 + 工单客户端加tenant-id

1. wechat_service: save/get_response_code 改为内存+数据库双写，
   容器重启后边缘resolve仍能更新企微卡片
2. work_order_client: 请求头加 tenant-id，签名公式加 query_str 参数
3. config: WorkOrderConfig 新增 tenant_id 字段

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/services/work_order_client.py

@@ -26,6 +26,7 @@ class WorkOrderClient:
         self._base_url = ""
         self._app_id = ""
         self._app_secret = ""
+        self._tenant_id = "1"
         self._timeout = 10
 
     def init(self, config):
@@ -34,6 +35,7 @@ class WorkOrderClient:
         self._base_url = config.base_url.rstrip("/")
         self._app_id = config.app_id
         self._app_secret = config.app_secret
+        self._tenant_id = getattr(config, "tenant_id", "1")
         self._timeout = getattr(config, "timeout", 10)
 
         if self._enabled:
@@ -45,29 +47,27 @@ class WorkOrderClient:
     def enabled(self) -> bool:
         return self._enabled
 
-    def _sign(self, body_json: str, nonce: str, timestamp: str) -> str:
+    def _sign(self, body_json: str, nonce: str, timestamp: str, query_str: str = "") -> str:
         """
         SHA256 签名
 
-        签名算法：SHA256(body_json + "appId=" + appId + "&nonce=" + nonce + "&timestamp=" + timestamp + appSecret)
+        签名算法：SHA256(query_str + body_json + header_str + appSecret)
+        - query_str: Query 参数按 key 字母升序排序拼接，无参数时为空串
+        - header_str: 固定顺序 appId=&nonce=&timestamp=
         """
-        raw = (
-            body_json
-            + "appId=" + self._app_id
-            + "&nonce=" + nonce
-            + "&timestamp=" + timestamp
-            + self._app_secret
-        )
+        header_str = f"appId={self._app_id}&nonce={nonce}&timestamp={timestamp}"
+        raw = f"{query_str}{body_json}{header_str}{self._app_secret}"
         return hashlib.sha256(raw.encode("utf-8")).hexdigest()
 
     def _build_headers(self, body_json: str) -> dict:
-        """构造请求头（含签名）"""
+        """构造请求头（含签名 + tenant-id）"""
         nonce = uuid.uuid4().hex[:16]
         timestamp = str(int(time.time() * 1000))
         sign = self._sign(body_json, nonce, timestamp)
 
         return {
             "Content-Type": "application/json",
+            "tenant-id": self._tenant_id,
             "appId": self._app_id,
             "nonce": nonce,
             "timestamp": timestamp,