fix(core): harden settlement and wallet integration

bootstrap/app.php

@@ -10,24 +10,24 @@
 */
 
 use App\Lottery\ErrorCode;
-use App\Support\ApiResponse;
 use App\Support\ApiMessage;
-use App\Support\ApiValidationErrors;
-use Illuminate\Http\Request;
 use Illuminate\Support\Str;
+use App\Support\ApiResponse;
+use Illuminate\Http\Request;
 use App\Support\LotteryLocale;
+use App\Support\ApiValidationErrors;
 use Illuminate\Foundation\Application;
 use App\Http\Middleware\EnsureAdminApi;
 use App\Http\Middleware\EnsurePlayerApi;
-use App\Http\Middleware\RecordAdminApiAudit;
 use Illuminate\Console\Scheduling\Schedule;
+use App\Http\Middleware\RecordAdminApiAudit;
 use Illuminate\Auth\AuthenticationException;
-use App\Http\Middleware\EnsureAdminApiResourcePermission;
 use Illuminate\Validation\ValidationException;
 use App\Http\Middleware\NegotiateLotteryLocale;
 use Illuminate\Foundation\Configuration\Exceptions;
 use Illuminate\Foundation\Configuration\Middleware;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
+use App\Http\Middleware\EnsureAdminApiResourcePermission;
 use Symfony\Component\HttpKernel\Exception\HttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Symfony\Component\HttpKernel\Exception\TooManyRequestsHttpException;
@@ -38,9 +38,15 @@ return Application::configure(basePath: dirname(__DIR__))
         // 自动加前缀 `api` + middleware `api`，见 routes/api.php
         api: __DIR__.'/../routes/api.php',
         commands: __DIR__.'/../routes/console.php',
-        channels: __DIR__.'/../routes/channels.php',
         health: '/up',
     )
+    ->withBroadcasting(
+        __DIR__.'/../routes/channels.php',
+        [
+            'prefix' => 'api',
+            'middleware' => ['api', 'lottery.player'],
+        ],
+    )
     ->withMiddleware(function (Middleware $middleware): void {
         // 多语言：必须在其他 api 中间件之前执行，以便鉴权失败时也能按语言返回 msg
         $middleware->api(prepend: [
@@ -106,7 +112,7 @@ return Application::configure(basePath: dirname(__DIR__))
             );
         });
 
-        $exceptions->render(function (\InvalidArgumentException $e, Request $request) use ($locale) {
+        $exceptions->render(function (InvalidArgumentException $e, Request $request) use ($locale) {
             if (! $request->is('api/*')) {
                 return null;
             }
@@ -173,7 +179,7 @@ return Application::configure(basePath: dirname(__DIR__))
             );
         });
 
-        $exceptions->render(function (HttpException $e, Request $request) use ($locale) {
+        $exceptions->render(function (HttpException $e, Request $request) {
             if (! $request->is('api/*')) {
                 return null;
             }