feat(core): harden sessions settlement and credit activity

tests/Feature/AdminApiResourcePermissionMiddlewareTest.php

@@ -1,8 +1,10 @@
 <?php
 
+use App\Models\Draw;
 use App\Models\AdminRole;
 use App\Models\AdminUser;
 use App\Lottery\ErrorCode;
+use App\Lottery\DrawStatus;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 use App\Support\AdminPermissionBridge;
@@ -95,6 +97,25 @@ test('admin api resource middleware denies wallet reconcile resource without per
         ->assertJsonPath('code', ErrorCode::AdminForbidden->value);
 });
 
+test('admin api resource middleware denies settlement review only account from running draw settlement', function (): void {
+    $token = mintAdminTokenWithLegacySlugs('resource_settlement_reviewer', ['prd.payout.review']);
+    $draw = Draw::query()->create([
+        'draw_no' => '20260722-2001',
+        'business_date' => '2026-07-22',
+        'sequence_no' => 2001,
+        'status' => DrawStatus::Cooldown->value,
+        'cooling_end_time' => now()->addMinutes(10),
+        'settle_version' => 0,
+    ]);
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->postJson("/api/v1/admin/draws/{$draw->id}/settlement/run")
+        ->assertForbidden()
+        ->assertJsonPath('code', ErrorCode::AdminForbidden->value);
+
+    expect($draw->fresh()->status)->toBe(DrawStatus::Cooldown->value);
+});
+
 test('admin api resource middleware allows wallet reconcile resource with mapped permission', function (): void {
     $token = mintAdminTokenWithLegacySlugs('resource_wallet_viewer', ['prd.wallet_reconcile.view']);