feat(admin): 密码校验统一与后台 API/设置增强

- 管理端账号/代理/站点等密码最短长度统一为 6 位
- LotterySettings、审计日志展示、币种与报表接口等小修复
- 补充设置批量更新、注单、校验错误等相关测试

tests/Feature/AdminSettingBatchUpdateTest.php

@@ -71,8 +71,28 @@ function settingsReadOnlyToken(): string
 }
 
 test('admin can batch update settings in one request', function (): void {
-    LotterySettings::put('draw.interval_minutes', 5, 'draw');
     LotterySettings::put('draw.cooldown_minutes', 15, 'draw');
+    LotterySettings::put('draw.require_manual_review', true, 'draw');
+
+    $token = settingsAdminToken();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->putJson('/api/v1/admin/settings/batch', [
+            'items' => [
+                ['key' => 'draw.cooldown_minutes', 'value' => 20],
+                ['key' => 'draw.require_manual_review', 'value' => false],
+            ],
+        ])
+        ->assertOk()
+        ->assertJsonPath('data.items.0.key', 'draw.cooldown_minutes');
+
+    expect(LotterySetting::query()->where('setting_key', 'draw.cooldown_minutes')->value('value_json'))->toBe(20)
+        ->and(LotterySetting::query()->where('setting_key', 'draw.require_manual_review')->value('value_json'))->toBeFalse();
+});
+
+test('admin cannot batch update env locked deployment settings', function (): void {
+    config(['lottery.draw.interval_minutes' => 5]);
+    LotterySettings::put('draw.interval_minutes', 5, 'draw');
 
     $token = settingsAdminToken();
 
@@ -80,14 +100,28 @@ test('admin can batch update settings in one request', function (): void {
         ->putJson('/api/v1/admin/settings/batch', [
             'items' => [
                 ['key' => 'draw.interval_minutes', 'value' => 10],
-                ['key' => 'draw.cooldown_minutes', 'value' => 20],
             ],
         ])
-        ->assertOk()
-        ->assertJsonPath('data.items.0.key', 'draw.cooldown_minutes');
+        ->assertForbidden();
 
-    expect(LotterySetting::query()->where('setting_key', 'draw.interval_minutes')->value('value_json'))->toBe(10)
-        ->and(LotterySetting::query()->where('setting_key', 'draw.cooldown_minutes')->value('value_json'))->toBe(20);
+    expect(LotterySettings::drawIntervalMinutes())->toBe(5);
+});
+
+test('admin settings deployment returns read only snapshot', function (): void {
+    config([
+        'lottery.default_currency' => 'USD',
+        'lottery.draw.interval_minutes' => 7,
+    ]);
+
+    $token = settingsAdminToken();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->getJson('/api/v1/admin/settings/deployment')
+        ->assertOk()
+        ->assertJsonPath('data.items.0.key', 'currency.default_code')
+        ->assertJsonPath('data.items.0.value', 'USD')
+        ->assertJsonPath('data.items.0.env_var', 'LOTTERY_DEFAULT_CURRENCY')
+        ->assertJsonFragment(['key' => 'draw.interval_minutes', 'value' => 7]);
 });
 
 test('admin settings batch update rejects empty items', function (): void {
@@ -199,13 +233,13 @@ test('wallet max limit cannot be less than current min limit', function (): void
 });
 
 test('settings updates require permission for their setting group', function (): void {
-    LotterySettings::put('draw.interval_minutes', 5, 'draw');
+    LotterySettings::put('draw.cooldown_minutes', 15, 'draw');
     LotterySettings::put('frontend.play_rules_html_zh', '<div>old</div>', 'frontend');
 
     $token = settingsReadOnlyToken();
 
     $this->withHeader('Authorization', 'Bearer '.$token)
-        ->putJson('/api/v1/admin/settings/draw.interval_minutes', [
+        ->putJson('/api/v1/admin/settings/draw.cooldown_minutes', [
             'value' => 10,
         ])
         ->assertForbidden();
@@ -216,6 +250,6 @@ test('settings updates require permission for their setting group', function ():
         ])
         ->assertOk();
 
-    expect(LotterySetting::query()->where('setting_key', 'draw.interval_minutes')->value('value_json'))->toBe(5)
+    expect(LotterySetting::query()->where('setting_key', 'draw.cooldown_minutes')->value('value_json'))->toBe(15)
         ->and(LotterySetting::query()->where('setting_key', 'frontend.play_rules_html_zh')->value('value_json'))->toBe('<div>new</div>');
 });