新增通过手机号获取排队信息的内部接口

server/README.md

@@ -56,6 +56,12 @@ endpoint. It accepts `{ "phone": "..." }` and returns all current active
 tickets associated with that phone. It is disabled when `APP_ENV=production`;
 replace it with OTP or an external identity interface before formal launch.
 
+`POST /api/internal/status/search` exposes the same active-ticket lookup to
+trusted backend services in every environment. It accepts `{ "phone": "..." }`
+and only allows direct peers on private or loopback networks. Do not publish
+this path through the public Ingress; callers must use the internal service
+address. Forwarded client-IP headers are intentionally ignored.
+
 ## Tests
 
 ```sh