feat(core): harden sessions settlement and credit activity

app/Http/Middleware/EnsureAdminApi.php

@@ -7,6 +7,7 @@ use App\Models\AdminUser;
 use App\Lottery\ErrorCode;
 use App\Support\ApiResponse;
 use Illuminate\Http\Request;
+use Laravel\Sanctum\PersonalAccessToken;
 use Symfony\Component\HttpFoundation\Response;
 
 /**
@@ -37,6 +38,25 @@ final class EnsureAdminApi
             );
         }
 
+        $accessToken = $user->currentAccessToken();
+        if (
+            (int) $user->admin_session_version > 0
+            && $accessToken instanceof PersonalAccessToken
+            && $accessToken->name === 'admin-api'
+        ) {
+            $expectedAbility = 'admin-session:'.(int) $user->admin_session_version;
+            $abilities = is_array($accessToken->abilities) ? $accessToken->abilities : [];
+
+            if (! in_array($expectedAbility, $abilities, true)) {
+                return ApiResponse::error(
+                    trans('admin.session_replaced', [], $request->lotteryLocale()),
+                    ErrorCode::AdminSessionReplaced->value,
+                    null,
+                    401,
+                );
+            }
+        }
+
         $request->attributes->set('lottery_admin', $user);
 
         return $next($request);