feat: 添加仪表盘接口，聚合财务、风控和待办计数，增强管理员 API 路由功能

tests/Feature/AdminDashboardApiTest.php

@@ -0,0 +1,73 @@
+<?php
+
+use App\Models\AdminUser;
+use App\Models\Draw;
+use App\Models\RiskPool;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
+
+uses(RefreshDatabase::class);
+
+test('admin dashboard aggregates hall finance and risk for super admin', function (): void {
+    $draw = Draw::query()->create([
+        'draw_no' => '20260512-010',
+        'business_date' => '2026-05-12',
+        'sequence_no' => 10,
+        'status' => 'open',
+        'start_time' => now()->subHour(),
+        'close_time' => now()->addHour(),
+        'draw_time' => now()->addHours(2),
+        'cooling_end_time' => null,
+        'result_source' => null,
+        'current_result_version' => 0,
+        'settle_version' => 0,
+        'is_reopened' => false,
+    ]);
+
+    RiskPool::query()->create([
+        'draw_id' => $draw->id,
+        'normalized_number' => '1234',
+        'total_cap_amount' => 1_000_000,
+        'locked_amount' => 200_000,
+        'remaining_amount' => 800_000,
+        'sold_out_status' => 0,
+        'version' => 1,
+    ]);
+
+    RiskPool::query()->create([
+        'draw_id' => $draw->id,
+        'normalized_number' => '9999',
+        'total_cap_amount' => 100,
+        'locked_amount' => 100,
+        'remaining_amount' => 0,
+        'sold_out_status' => 1,
+        'version' => 2,
+    ]);
+
+    $admin = AdminUser::query()->create([
+        'username' => 'dash_admin',
+        'name' => 'Dash QA',
+        'email' => null,
+        'password' => Hash::make('secret-strong'),
+        'status' => 0,
+    ]);
+    grantSuperAdminRole($admin);
+    $token = $admin->createToken('test', ['*'], now()->addDay())->plainTextToken;
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->getJson('/api/v1/admin/dashboard')
+        ->assertOk()
+        ->assertJsonPath('data.hall.draw_no', '20260512-010')
+        ->assertJsonPath('data.resolved_draw.id', $draw->id)
+        ->assertJsonPath('data.capabilities.draw_finance_risk', true)
+        ->assertJsonPath('data.capabilities.wallet_transfer_view', true)
+        ->assertJsonPath('data.finance.draw_id', $draw->id)
+        ->assertJsonPath('data.draw.result_batch_counts.total', 0)
+        ->assertJsonPath('data.risk.locked_amount', 200_100)
+        ->assertJsonPath('data.risk.cap_amount', 1_000_100)
+        ->assertJsonPath('data.risk.sold_out_buckets.d4', 1);
+});
+
+test('admin dashboard returns 401 without token', function (): void {
+    $this->getJson('/api/v1/admin/dashboard')->assertStatus(401);
+});