feat: enhance agent management and validation logic

- Updated AGENTS.md to clarify agent account restrictions and permissions.
- Implemented checks in AgentNodeAdminUserStoreController and AgentNodeRoleStoreController to restrict admin user and role creation to the agent's own node.
- Enhanced validation in AdminPlayerStoreController and AdminPlayerUpdateController to enforce credit limit and rebate rate rules based on player funding mode.
- Refactored various request classes to utilize shared admin account field rules for consistency.
- Improved error handling in services related to credit allocation and rebate limits to ensure proper validation and messaging.

tests/Feature/AdminPlayerManageApiTest.php

@@ -320,3 +320,56 @@ test('admin can set player credit limit without clobbering used credit', functio
         'used_credit' => 120,
     ]);
 });
+
+test('wallet player update rejects credit limit and rebate', function (): void {
+    $siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
+    $siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
+
+    $player = Player::query()->create([
+        'site_code' => $siteCode,
+        'site_player_id' => 'wallet-no-credit-1',
+        'auth_source' => PlayerAuthSource::MAIN_SITE_SSO,
+        'funding_mode' => PlayerFundingMode::WALLET,
+        'username' => 'wallet_user',
+        'default_currency' => 'NPR',
+        'status' => 0,
+    ]);
+
+    PlayerWallet::query()->create([
+        'player_id' => $player->id,
+        'currency_code' => 'NPR',
+        'balance_minor' => 0,
+    ]);
+
+    $token = playerManageAdminToken();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->putJson('/api/v1/admin/players/'.$player->id, [
+            'credit_limit' => 1000,
+        ])
+        ->assertStatus(422)
+        ->assertJsonPath('code', \App\Lottery\ErrorCode::ValidationFailed->value);
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->putJson('/api/v1/admin/players/'.$player->id, [
+            'rebate_rate' => 1,
+        ])
+        ->assertStatus(422)
+        ->assertJsonPath('code', \App\Lottery\ErrorCode::ValidationFailed->value);
+});
+
+test('native player create rejects chinese username', function (): void {
+    $siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
+    $siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
+    $token = playerManageAdminToken();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->postJson('/api/v1/admin/players', [
+            'site_code' => $siteCode,
+            'username' => '玩家账号',
+            'password' => 'secret-native',
+            'default_currency' => 'NPR',
+        ])
+        ->assertStatus(422)
+        ->assertJsonPath('code', \App\Lottery\ErrorCode::ValidationFailed->value);
+});