fix(core): harden settlement and wallet integration

app/Services/PlayerTokenResolver.php

@@ -11,6 +11,7 @@ use App\Support\PlayerAuthSource;
 use App\Support\PlayerFundingMode;
 use App\Support\PlayerTokenAesUnwrap;
 use Illuminate\Database\QueryException;
+use App\Services\Player\NativeJwtSecretGuard;
 use App\Support\PlayerAutoRegistrationDefaults;
 use App\Exceptions\PlayerAuthenticationException;
 use App\Services\Integration\PartnerSiteConfigResolver;
@@ -42,6 +43,7 @@ final class PlayerTokenResolver
 
     public function __construct(
         private readonly PartnerSiteConfigResolver $partnerSiteConfigResolver,
+        private readonly NativeJwtSecretGuard $nativeJwtSecretGuard,
     ) {}
 
     public function resolve(Request $request): Player
@@ -158,14 +160,7 @@ final class PlayerTokenResolver
 
     private function resolveNativeJwt(string $jwt): Player
     {
-        $secret = (string) config('lottery.player_auth.native.secret', '');
-        if ($secret === '') {
-            throw new PlayerAuthenticationException(
-                '原生登录未配置',
-                ErrorCode::PlayerSsoSecretNotConfigured->value,
-                503,
-            );
-        }
+        $secret = $this->nativeJwtSecretGuard->validatedSecret();
 
         $alg = (string) config('lottery.player_auth.jwt.algorithm', 'HS256');
 
@@ -256,6 +251,14 @@ final class PlayerTokenResolver
             }
         }
 
+        if ((string) $player->auth_source !== PlayerAuthSource::MAIN_SITE_SSO
+            || (string) $player->funding_mode !== PlayerFundingMode::WALLET) {
+            throw new PlayerAuthenticationException(
+                'SSO 玩家映射与账号认证域冲突',
+                ErrorCode::PlayerTokenInvalid->value,
+            );
+        }
+
         if (! $player->wasRecentlyCreated) {
             $player->forceFill(['last_login_at' => $now])->save();
         }