fix(core): harden settlement and wallet integration

tests/Feature/WalletTransferScenariosTest.php

@@ -18,6 +18,7 @@ use Illuminate\Foundation\Testing\RefreshDatabase;
 uses(RefreshDatabase::class);
 
 beforeEach(function (): void {
+    fakeWalletApiDns();
     config(['lottery.main_site.wallet_api_url' => null]);
     $this->seed(CurrencySeeder::class);
     $this->seed(LotterySettingsSeeder::class);
@@ -139,6 +140,38 @@ test('transfer in main site explicit failure returns 1009 and marks order failed
         ->and(WalletTxn::query()->where('player_id', $player->id)->count())->toBe(0);
 });
 
+test('transfer in rejects private dns answer before sending wallet bearer request', function (): void {
+    fakeWalletApiDns([
+        'private-debit.test' => ['10.0.0.8'],
+    ], []);
+    Http::preventStrayRequests();
+    config(['lottery.main_site.wallet_api_url' => 'https://private-debit.test']);
+    config(['lottery.main_site.wallet_debit_path' => 'debit']);
+
+    $player = Player::query()->create([
+        'site_code' => 'main',
+        'site_player_id' => 'private-dns-in',
+        'username' => null,
+        'nickname' => null,
+        'default_currency' => 'NPR',
+        'status' => 0,
+    ]);
+
+    $key = 'private-dns-in-'.uniqid('', true);
+
+    $this->withHeader('Authorization', 'Bearer dev:'.$player->id)
+        ->postJson('/api/v1/wallet/transfer-in', [
+            'amount' => 500,
+            'currency' => 'NPR',
+            'idempotent_key' => $key,
+        ])
+        ->assertStatus(400)
+        ->assertJsonPath('code', ErrorCode::WalletExternalRejected->value);
+
+    expect(TransferOrder::query()->where('idempotent_key', $key)->value('status'))->toBe('failed');
+    Http::assertSentCount(0);
+});
+
 test('transfer in main site timeout returns 1002 and pending_reconcile', function (): void {
     Http::fake([
         'timeout-debit.test/*' => Http::response([], 504),