点单获取商品先查 guanshi_saoma，扫过则强制只返回隐藏式4；扫码标记强制落库并校验。

Co-authored-by: Cursor <cursoragent@cursor.com>

utils/jwt_auth.py

@@ -37,3 +37,16 @@ class YonghuidJWTAuthentication(JWTAuthentication):
             if self.user_model.objects.filter(id=int(legacy_id)).exists():
                 return legacy_id, 'id'
         return legacy_id, field
+
+
+class OptionalYonghuidJWTAuthentication(YonghuidJWTAuthentication):
+    """可选登录：有合法 token 则识别用户，无/坏 token 当匿名，不打断 AllowAny 接口。"""
+
+    def authenticate(self, request):
+        header = self.get_header(request)
+        if header is None:
+            return None
+        try:
+            return super().authenticate(request)
+        except (InvalidToken, AuthenticationFailed):
+            return None