feat: 修复 H5 底部导航覆盖 + 更新项目进度文档

## H5 底部导航修复 (Bug #10)
- 精简 App.vue，移除重复 tabbar，仅保留全局样式
- uni-page 设置 height: calc(100% - 50px) + overflow-y: auto
- 内容区域精确停在底部导航上方，独立滚动不再叠加
- 恢复 custom-tab-bar 组件

## 项目进度文档
- PROGRESS.md 更新至 10 个 Bug 修复
- 新增 H5 底部导航修复记录
- 新增历史变更条目

backend/app/api/v1/whatsapp.py

@@ -1,13 +1,14 @@
-from fastapi import APIRouter, Request, HTTPException, Depends
+from fastapi import APIRouter, Request, HTTPException, Depends, Header
 from sqlalchemy.ext.asyncio import AsyncSession
-from typing import Annotated
+from sqlalchemy import select, and_
+from typing import Annotated, Optional
+from pydantic import BaseModel
 from app.database import get_db
 from app.services.whatsapp import WhatsAppService
 from app.services.customer import CustomerService
-from app.services.translation import TranslationService
-from app.core.security import decode_token
 from app.api.v1.deps import get_current_user_id
-from app.config import settings
+from app.models.customer import Customer
+from app.models.user import User
 
 router = APIRouter()
 
@@ -26,35 +27,92 @@ async def verify_webhook(
 
 
 @router.post("/webhook")
-async def handle_webhook(request: Request, db: Annotated[AsyncSession, Depends(get_db)] = None):
+async def handle_webhook(
+    request: Request,
+    x_hub_signature_256: Optional[str] = Header(None),
+    db: Annotated[AsyncSession, Depends(get_db)] = None,
+):
     svc = WhatsAppService()
-    body = await request.json()
+    body = await request.body()
 
-    msg_data = svc.parse_webhook(body)
+    if x_hub_signature_256:
+        if not svc.verify_signature(body, x_hub_signature_256):
+            raise HTTPException(status_code=403, detail="Invalid signature")
+
+    import json
+    body_json = json.loads(body)
+    msg_data = svc.parse_webhook(body_json)
     if not msg_data:
         return {"status": "ok"}
 
-    # TODO: Route to correct user based on WhatsApp number
-    # For MVP, handle as generic incoming message
+    from_number = msg_data.get("from")
+    text = msg_data.get("text", "")
+
+    if from_number:
+        result = await db.execute(
+            select(Customer).where(Customer.whatsapp_id == from_number)
+        )
+        customer = result.scalar_one_or_none()
+
+        if customer:
+            user_id = str(customer.user_id)
+            cust_svc = CustomerService(db)
+            await cust_svc.save_message(
+                user_id=user_id,
+                customer_id=str(customer.id),
+                direction="inbound",
+                content=text,
+            )
+
     return {"status": "ok", "message": "received"}
 
 
+class SendMessageRequest(BaseModel):
+    to: str
+    text: str = ""
+    template_name: Optional[str] = None
+    template_params: Optional[dict] = None
+    media_url: Optional[str] = None
+    media_type: Optional[str] = None
+
+
 @router.post("/send")
 async def send_message(
-    data: dict,
+    data: SendMessageRequest,
     user_id: str = Depends(get_current_user_id),
+    db: Annotated[AsyncSession, Depends(get_db)] = None,
 ):
-    text = data.get("text")
-    to = data.get("to")
-    if not text or not to:
-        raise HTTPException(status_code=400, detail="text and to are required")
-
     svc = WhatsAppService()
-    sent = await svc.send_text(to, text)
+
+    sent = False
+    if data.template_name and data.template_params:
+        sent = await svc.send_template(data.to, data.template_name, data.template_params)
+    elif data.media_url and data.media_type:
+        sent = await svc.send_media(data.to, data.media_url, data.media_type, caption=data.text)
+    elif data.text:
+        sent = await svc.send_text(data.to, data.text)
+    else:
+        raise HTTPException(status_code=400, detail="text, template, or media required")
+
     if not sent:
         raise HTTPException(status_code=500, detail="Failed to send WhatsApp message")
 
-    return {"status": "sent", "to": to}
+    cust_svc = CustomerService(db)
+    result = await db.execute(
+        select(Customer).where(
+            and_(Customer.whatsapp_id == data.to, Customer.user_id == user_id)
+        )
+    )
+    customer = result.scalar_one_or_none()
+    if customer:
+        await cust_svc.save_message(
+            user_id=user_id,
+            customer_id=str(customer.id),
+            direction="outbound",
+            content=data.text or f"[{data.media_type or 'template'}]",
+        )
+
+    return {"status": "sent", "to": data.to}
 
 
 @router.get("/qr")