fix(core): harden settlement and wallet integration

config/lottery.php

@@ -18,6 +18,7 @@ return [
 
     'settlement' => [
         'default_timezone' => env('LOTTERY_SETTLEMENT_TIMEZONE', env('APP_TIMEZONE', 'UTC')),
+        'ticket_chunk_size' => max(1, (int) env('LOTTERY_SETTLEMENT_TICKET_CHUNK_SIZE', 10_000)),
     ],
 
     /*
@@ -63,6 +64,7 @@ return [
     | jwt.*           ：主站签发的 JWT；验签通过后若无映射行则自动建档
     | max_ttl_seconds ：允许 (exp-iat) 最大秒数（默认 300=5 分钟），与「短效 Token」对齐
     | require_iat_claim：为 true 时必须带 iat，否则拒绝（不建档）
+    | native.secret    ：原生玩家 JWT 专用密钥；必须显式配置且不得与任何 SSO 密钥共用
     |
     | aes.key_base64  ：可选。32 字节原始密钥再做 Base64 写入 env LOTTERY_PLAYER_TOKEN_AES_KEY；
     |                  有值时 Bearer 串（非 xxx.yyy.zzz 外形）会先尝试 AES-GCM 解包为内层 JWT 再验签。
@@ -80,7 +82,7 @@ return [
             'key_base64' => env('LOTTERY_PLAYER_TOKEN_AES_KEY'),
         ],
         'native' => [
-            'secret' => env('LOTTERY_NATIVE_JWT_SECRET', env('MAIN_SITE_SSO_JWT_SECRET', '')),
+            'secret' => env('LOTTERY_NATIVE_JWT_SECRET'),
             'ttl_seconds' => max(300, min(86400, (int) env('LOTTERY_NATIVE_JWT_TTL_SECONDS', 28800))),
             'claim_player_id' => 'player_id',
             'claim_auth_source' => 'auth_source',
@@ -132,5 +134,4 @@ return [
     'draw_tick_settle_limit' => max(1, (int) env('LOTTERY_DRAW_TICK_SETTLE_LIMIT', 3)),
     'draw_tick_finalize_limit' => max(1, (int) env('LOTTERY_DRAW_TICK_FINALIZE_LIMIT', 5)),
     'draw_tick_rng_limit' => max(1, (int) env('LOTTERY_DRAW_TICK_RNG_LIMIT', 10)),
-
 ];

config/reverb.php

@@ -1,5 +1,31 @@
 <?php
 
+$configuredAllowedOrigins = trim((string) env('REVERB_ALLOWED_ORIGINS', ''));
+if ($configuredAllowedOrigins === '') {
+    $configuredAllowedOrigins = trim((string) env('CORS_ALLOWED_ORIGINS', ''));
+}
+if ($configuredAllowedOrigins === '' && env('APP_ENV', 'production') === 'local') {
+    $configuredAllowedOrigins = 'localhost,127.0.0.1';
+}
+
+$allowedOrigins = array_values(array_unique(array_filter(array_map(
+    static function (string $origin): string {
+        $origin = trim($origin);
+        if ($origin === '' || $origin === '*') {
+            return '';
+        }
+
+        if (str_starts_with($origin, '*.')) {
+            return strtolower($origin);
+        }
+
+        $host = parse_url(str_contains($origin, '://') ? $origin : '//'.$origin, PHP_URL_HOST);
+
+        return is_string($host) ? strtolower($host) : '';
+    },
+    explode(',', $configuredAllowedOrigins),
+))));
+
 return [
     /*
     |--------------------------------------------------------------------------
@@ -78,7 +104,7 @@ return [
                     'scheme' => env('REVERB_SCHEME', 'https'),
                     'useTLS' => env('REVERB_SCHEME', 'https') === 'https',
                 ],
-                'allowed_origins' => ['*'],
+                'allowed_origins' => $allowedOrigins,
                 'ping_interval' => env('REVERB_APP_PING_INTERVAL', 60),
                 'activity_timeout' => env('REVERB_APP_ACTIVITY_TIMEOUT', 30),
                 'max_connections' => env('REVERB_APP_MAX_CONNECTIONS'),