fix(core): harden settlement and wallet integration

tests/Feature/PlayerFoundationTest.php

@@ -116,6 +116,37 @@ test('jwt first successful login auto-registers player mapping', function () {
         ->and($player->nickname)->toBe($username);
 });
 
+test('main site sso jwt cannot take over an existing native credit player mapping', function (): void {
+    config(['lottery.player_auth.dev_bypass' => false]);
+    config(['lottery.main_site.sso_jwt_secret' => 'jwt-test-secret-at-least-32-bytes-long']);
+
+    $native = Player::query()->create([
+        'site_code' => 'main',
+        'site_player_id' => 'native-sso-collision',
+        'auth_source' => 'lottery_native',
+        'funding_mode' => 'credit',
+        'username' => 'native_collision',
+        'nickname' => null,
+        'default_currency' => 'NPR',
+        'status' => 0,
+    ]);
+
+    $now = time();
+    $jwt = JWT::encode([
+        'site_code' => 'main',
+        'site_player_id' => $native->site_player_id,
+        'iat' => $now,
+        'exp' => $now + 300,
+    ], 'jwt-test-secret-at-least-32-bytes-long', 'HS256');
+
+    $this->withHeader('Authorization', 'Bearer '.$jwt)
+        ->getJson('/api/v1/player/me')
+        ->assertUnauthorized()
+        ->assertJsonPath('code', ErrorCode::PlayerTokenInvalid->value);
+
+    expect($native->fresh()->last_login_at)->toBeNull();
+});
+
 test('player me rejects non-active status with 8005', function () {
     $code = ErrorCode::PlayerAccountSuspended->value;
     $player = Player::query()->create([