feat: enhance agent management and validation logic

- Updated AGENTS.md to clarify agent account restrictions and permissions.
- Implemented checks in AgentNodeAdminUserStoreController and AgentNodeRoleStoreController to restrict admin user and role creation to the agent's own node.
- Enhanced validation in AdminPlayerStoreController and AdminPlayerUpdateController to enforce credit limit and rebate rate rules based on player funding mode.
- Refactored various request classes to utilize shared admin account field rules for consistency.
- Improved error handling in services related to credit allocation and rebate limits to ensure proper validation and messaging.

database/migrations/2026_06_13_120000_add_draw_reopen_api_resource.php

@@ -0,0 +1,118 @@
+<?php
+
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Database\Migrations\Migration;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        $now = Carbon::now();
+
+        // Add menu action for draw reopen if not exists
+        $drawMenuId = (int) DB::table('admin_menus')->where('code', 'lottery.draw')->value('id');
+        $reopenActionId = (int) DB::table('admin_action_catalog')->where('code', 'reopen')->value('id');
+
+        if ($drawMenuId > 0 && $reopenActionId > 0) {
+            DB::table('admin_menu_actions')->updateOrInsert(
+                ['permission_code' => 'draw.reopen'],
+                [
+                    'menu_id' => $drawMenuId,
+                    'action_id' => $reopenActionId,
+                    'name' => '期号重开',
+                    'status' => 1,
+                    'created_at' => $now,
+                    'updated_at' => $now,
+                ],
+            );
+        }
+
+        // Add permission if not exists
+        if (Schema::hasTable('admin_permissions')) {
+            DB::table('admin_permissions')->updateOrInsert(
+                ['slug' => 'prd.draw_reopen.manage'],
+                [
+                    'name' => '期号重开·可管理',
+                    'created_at' => $now,
+                    'updated_at' => $now,
+                ],
+            );
+        }
+
+        // Add API resource
+        $resourceId = DB::table('admin_api_resources')
+            ->where('code', 'admin.draws.reopen')
+            ->value('id');
+
+        if ($resourceId === null) {
+            $resourceId = DB::table('admin_api_resources')->insertGetId([
+                'code' => 'admin.draws.reopen',
+                'route_name' => 'api.v1.admin.draws.reopen',
+                'name' => '期号重开',
+                'auth_mode' => 'permission',
+                'status' => 1,
+                'created_at' => $now,
+                'updated_at' => $now,
+            ]);
+        }
+
+        // Bind permission to resource
+        $menuActionId = (int) DB::table('admin_menu_actions')
+            ->where('permission_code', 'draw.reopen')
+            ->value('id');
+
+        if ($resourceId > 0 && $menuActionId > 0) {
+            DB::table('admin_api_resource_bindings')->updateOrInsert(
+                [
+                    'api_resource_id' => (int) $resourceId,
+                    'menu_action_id' => $menuActionId,
+                ],
+                [
+                    'created_at' => $now,
+                    'updated_at' => $now,
+                ],
+            );
+        }
+
+        // Grant to super admin
+        $superRoleId = (int) DB::table('admin_roles')->where('slug', 'super_admin')->value('id');
+        if ($superRoleId > 0) {
+            if (Schema::hasTable('admin_role_legacy_permissions')) {
+                DB::table('admin_role_legacy_permissions')->updateOrInsert(
+                    [
+                        'role_id' => $superRoleId,
+                        'permission_slug' => 'prd.draw_reopen.manage',
+                    ],
+                    [
+                        'created_at' => $now,
+                        'updated_at' => $now,
+                    ],
+                );
+            }
+
+            if ($menuActionId > 0) {
+                DB::table('admin_role_menu_actions')->updateOrInsert(
+                    [
+                        'role_id' => $superRoleId,
+                        'menu_action_id' => $menuActionId,
+                    ],
+                    [],
+                );
+            }
+
+            if (Schema::hasTable('admin_role_api_resources')) {
+                DB::table('admin_role_api_resources')->updateOrInsert([
+                    'role_id' => $superRoleId,
+                    'api_resource_id' => (int) $resourceId,
+                ], []);
+            }
+        }
+    }
+
+    public function down(): void
+    {
+        // Avoid deleting production authorization bindings
+    }
+};