diff --git a/src/modules/openapi/ApplyApiKeyDialog.vue b/src/modules/openapi/ApplyApiKeyDialog.vue
index b566b9e..00d2624 100644
--- a/src/modules/openapi/ApplyApiKeyDialog.vue
+++ b/src/modules/openapi/ApplyApiKeyDialog.vue
@@ -16,7 +16,7 @@
  *
  * 后端调 /sys/openapi/app/apply
  */
-import { ref, reactive, computed, watch } from 'vue'
+import { ref, reactive, watch } from 'vue'
 import { ElMessage } from 'element-plus'
 import { httpGet, httpPost } from '@/utils/request'
 
@@ -70,10 +70,14 @@ const form = reactive({
 const customers = ref<Customer[]>([])
 const loadingCustomers = ref(false)
 
-async function loadCustomers() {
+// F002-W18 修: 后端已支持 name 模糊搜, 前端把 searchKey 传给后端, 不再本地 filter
+async function loadCustomers(searchKey?: string) {
   loadingCustomers.value = true
   try {
-    const data = await httpGet<Customer[]>('/sys/openapi/customer/list')
+    const data = await httpGet<Customer[]>('/sys/openapi/customer/list', {
+      name: searchKey || undefined,
+      limit: 1000
+    })
     customers.value = Array.isArray(data) ? data : []
   } catch (e: any) {
     ElMessage.error(e?.msg || e?.message || '加载客户列表失败')
@@ -85,13 +89,13 @@ async function loadCustomers() {
 
 watch(visible, v => { if (v) loadCustomers() })
 
-const filteredCustomers = computed(() => {
-  if (!form.searchKey) return customers.value
-  const k = form.searchKey.toLowerCase()
-  return customers.value.filter(c =>
-    (c.customerName || '').toLowerCase().includes(k) ||
-    (c.customerCode || '').toLowerCase().includes(k)
-  )
+// F002-W18 修: searchKey 变化 debounce 300ms 调后端
+let searchTimer: ReturnType<typeof setTimeout> | null = null
+watch(() => form.searchKey, (val) => {
+  if (searchTimer) clearTimeout(searchTimer)
+  searchTimer = setTimeout(() => {
+    loadCustomers(val || undefined)
+  }, 300)
 })
 
 function onSelectionChange(rows: Customer[]) {
@@ -246,7 +250,7 @@ function notifyContact() {
       />
       <el-table
         ref="customerTableRef"
-        :data="filteredCustomers"
+        :data="customers"
         border
         size="small"
         max-height="320"
diff --git a/src/stores/menu.ts b/src/stores/menu.ts
index 0b0e7c1..459752d 100644
--- a/src/stores/menu.ts
+++ b/src/stores/menu.ts
@@ -69,10 +69,12 @@ export const useMenuStore = defineStore('menu', () => {
           if (!filtered.length) return null
           return { ...item, children: filtered }
         }
-        // 子菜单: url 必须在 MENU_LABELS 里, 且首次出现
-        if (!allowedUrls.has(item.url)) return null
-        if (seenUrls.has(item.url)) return null
-        seenUrls.add(item.url)
+        // F002-W18 修: 后端 url 可能带 / 前缀 (如 /user/enterprise/enterprise),
+        // MENU_LABELS 不带 / (如 user/enterprise/enterprise), 规范化后匹配
+        const normalizedUrl = item.url.replace(/^\//, '')
+        if (!allowedUrls.has(item.url) && !allowedUrls.has(normalizedUrl)) return null
+        if (seenUrls.has(normalizedUrl)) return null
+        seenUrls.add(normalizedUrl)
         return item
       })
       .filter((item): item is ResolvedMenu => item !== null)
diff --git a/src/utils/request.ts b/src/utils/request.ts
index a266529..517d556 100644
--- a/src/utils/request.ts
+++ b/src/utils/request.ts
@@ -19,7 +19,9 @@ export interface ApiEnvelope<T = any> {
 const STORAGE_KEY = 'access_token'
 
 export const http: AxiosInstance = axios.create({
-  baseURL: '',
+  // F002-W18 修: baseURL '/api' 让巨变数字 nginx /api/ location 转发 (去 /api 前缀)
+  // devbox nginx 同样有 /api/ location (rewrite ^/api/(.*)$ /$1 break), 兼容
+  baseURL: '/api',
   timeout: 15000
 })