feat: update personal stats and cms change reuqest method

apps/user/cms.py

@@ -165,7 +165,8 @@ class CmsUserViewSet(viewsets.ModelViewSet):
     filter_backends = [DjangoFilterBackend, filters.SearchFilter]
     filterset_fields = ['role_type', 'institution', 'status', 'gender']
     search_fields = ['username', 'real_name', 'phone']
-    http_method_names = ['get', 'post', 'patch', 'delete', 'head', 'options']
+    # 仅 GET / POST：查=GET，增删改=POST（编辑→{id}/update/，停用→{id}/disable/）
+    http_method_names = ['get', 'post', 'head', 'options']
 
     def get_queryset(self):
         qs = User.objects.select_related('institution', 'department').all().order_by('-created_at')
@@ -176,7 +177,7 @@ class CmsUserViewSet(viewsets.ModelViewSet):
         return qs.filter(institution_id=user.institution_id, role_type__in=HOSPITAL_ADMIN_ROLES)
 
     def get_serializer_class(self):
-        if self.action in ('create', 'update', 'partial_update'):
+        if self.action in ('create', 'update_user'):
             return CmsUserWriteSerializer
         return CmsUserSerializer
 
@@ -186,14 +187,23 @@ class CmsUserViewSet(viewsets.ModelViewSet):
         user = write.save()
         return Response(CmsUserSerializer(user).data, status=status.HTTP_201_CREATED)
 
-    def update(self, request, *args, **kwargs):
-        partial = kwargs.pop('partial', False)
+    @extend_schema(summary='CMS-USER-3 编辑用户', tags=['CMS-用户'])
+    @action(detail=True, methods=['post'], url_path='update')
+    def update_user(self, request, pk=None):
+        """编辑用户（POST 局部更新，等价旧 PATCH /{id}/）。"""
         instance = self.get_object()
-        write = self.get_serializer(instance, data=request.data, partial=partial)
+        write = self.get_serializer(instance, data=request.data, partial=True)
         write.is_valid(raise_exception=True)
         user = write.save()
         return Response(CmsUserSerializer(user).data)
 
+    @extend_schema(summary='CMS-USER-4 停用用户（逻辑删除）', tags=['CMS-用户'])
+    @action(detail=True, methods=['post'], url_path='disable')
+    def disable(self, request, pk=None):
+        """停用用户（软删除，等价旧 DELETE /{id}/）。"""
+        self.get_object().delete()
+        return Response({'message': '已停用'})
+
     @extend_schema(summary='CMS-USER-5 重置密码', tags=['CMS-用户'])
     @action(detail=True, methods=['post'], url_path='reset-password')
     def reset_password(self, request, pk=None):