feat: 强制在控制器层提取context.Context中的数据，服务方法需接受显式参数

backend/llm.txt

@@ -46,6 +46,7 @@ This file condenses `backend/docs/dev/http_api.md` + `backend/docs/dev/model.md`
 - MUST: when creating/generating Go `struct` definitions (DTOs/requests/responses/etc.), add detailed per-field comments describing meaning, usage scenario, and validation/usage rules (do not rely on “self-explanatory” names).
 - MUST: business code comments MUST be written in Chinese (中文注释), to keep review/maintenance consistent across the team.
 - MUST: in `backend/app/services`, add Chinese comments at key steps to explain business intent and invariants (e.g., 事务边界、幂等语义、余额冻结/扣减/回滚、权限/前置条件校验点), avoid “what the code does” boilerplate.
+- MUST: Data extraction from `context.Context` (e.g., `userID`, `tenantID`) MUST be done in the **Controller** layer. Services MUST NOT extract data from `ctx`. Service methods MUST accept explicit parameters (e.g., `func (s *Service) DoSomething(ctx context.Context, userID int64, ...) error`).
 
 ---