feat: add points risk report

docs/refactor/taro-frontend-integration.md

@@ -1277,9 +1277,30 @@ GET /api/tenant-admin/point-activity-claims?taskId=<task-id>&userId=<student-id>
 GET /api/tenant-admin/point-exchange-items?status=active
 PUT /api/tenant-admin/point-exchange-items
 GET /api/tenant-admin/point-exchange-orders?itemId=<item-id>&status=pending_fulfillment
+GET /api/tenant-admin/points-risk-report?timeRange=30d&limit=20
 ```
 
-当前 Taro 第一版已经把租户积分运营嵌入 `apps/taro/src/pages/tenant-admin/marketing/index.tsx`，支持任务配置、兑换商品配置、任务领取记录和兑换订单查看。前端只提交配置和筛选条件，权限、优惠券/资源归属、库存、限购、积分扣减和审计仍由后端处理。
+积分风控报表是只读运营视角：
+
+```json
+{
+  "item": {
+    "range": { "timeRange": "30d", "startDate": "2026-06-01", "endDate": "2026-06-30" },
+    "summary": {
+      "eventCount": 120,
+      "suspiciousUserCount": 3,
+      "suspiciousEventCount": 4,
+      "riskScore": 28
+    },
+    "suspiciousUsers": [],
+    "suspiciousEvents": [],
+    "suspiciousTasks": [],
+    "suspiciousExchanges": []
+  }
+}
+```
+
+当前 Taro 第一版已经把租户积分运营嵌入 `apps/taro/src/pages/tenant-admin/marketing/index.tsx`，支持任务配置、兑换商品配置、任务领取记录、兑换订单查看和 30 天只读风控摘要。前端只提交配置和筛选条件，权限、优惠券/资源归属、库存、限购、积分扣减、风控阈值统计和审计仍由后端处理。积分风控只用于提示运营人工排查，不在前端直接冻结用户、扣回积分、取消权益或隐藏内容。
 
 每日签到奖励配置复用同一组积分任务接口：