feat: enhance agent management and validation logic

- Updated AGENTS.md to clarify agent account restrictions and permissions.
- Implemented checks in AgentNodeAdminUserStoreController and AgentNodeRoleStoreController to restrict admin user and role creation to the agent's own node.
- Enhanced validation in AdminPlayerStoreController and AdminPlayerUpdateController to enforce credit limit and rebate rate rules based on player funding mode.
- Refactored various request classes to utilize shared admin account field rules for consistency.
- Improved error handling in services related to credit allocation and rebate limits to ensure proper validation and messaging.

tests/Feature/TicketBettingApiTest.php

@@ -974,6 +974,65 @@ test('ticket preview and place apply base rebate plus player add-on rebate for w
     expect((int) $wallet->balance)->toBe(500_000 - 9_830);
 });
 
+test('credit player ticket preview shows period rebate estimate without instant deduct', function (): void {
+    $site = DB::table('admin_sites')->where('is_default', true)->first();
+    $rootId = (int) DB::table('agent_nodes')->where('depth', 0)->value('id');
+
+    $player = Player::query()->create([
+        'site_code' => (string) $site->code,
+        'agent_node_id' => $rootId,
+        'site_player_id' => 'native:credit-rebate-preview',
+        'auth_source' => 'lottery_native',
+        'funding_mode' => 'credit',
+        'username' => 'credit_rebate_user',
+        'password_hash' => bcrypt('secret-pass'),
+        'nickname' => null,
+        'default_currency' => 'NPR',
+        'status' => 0,
+    ]);
+
+    DB::table('player_credit_accounts')->insert([
+        'player_id' => $player->id,
+        'credit_limit' => 500_000,
+        'used_credit' => 0,
+        'frozen_credit' => 0,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    DB::table('player_rebate_profiles')->insert([
+        'player_id' => $player->id,
+        'game_type' => '*',
+        'rebate_rate' => 0.10,
+        'extra_rebate_rate' => 0,
+        'inherit_from_agent' => false,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    ticketOpenDraw('20260511-credit-rebate');
+
+    $payload = [
+        'draw_id' => '20260511-credit-rebate',
+        'currency_code' => 'NPR',
+        'client_trace_id' => 'trace-credit-rebate-preview',
+        'lines' => [
+            ['number' => '12', 'play_code' => 'pos_2a', 'amount' => 10_000],
+        ],
+    ];
+
+    $this->withHeader('Authorization', 'Bearer dev:'.$player->id)
+        ->postJson('/api/v1/ticket/preview', $payload)
+        ->assertOk()
+        ->assertJsonPath('data.summary.total_bet_amount', 10_000)
+        ->assertJsonPath('data.summary.total_rebate_amount', 1_000)
+        ->assertJsonPath('data.summary.total_actual_deduct', 10_000)
+        ->assertJsonPath('data.summary.instant_rebate_applied', false)
+        ->assertJsonPath('data.lines.0.rebate_rate', '0.1000')
+        ->assertJsonPath('data.lines.0.rebate_amount', 1_000)
+        ->assertJsonPath('data.lines.0.actual_deduct_amount', 10_000);
+});
+
 test('ticket pending confirmation reconcile releases risk when wallet deduction is missing', function (): void {
     $draw = ticketOpenDraw();
     $player = ticketPlayerWithWallet();