feat: 扩展奖池、风控与报表能力，新增对账补偿、广播和人工操作接口

tests/Feature/AdminRiskPoolApiTest.php

@@ -5,7 +5,9 @@ use App\Models\RiskPool;
 use App\Models\AdminUser;
 use App\Models\RiskPoolLockLog;
 use Illuminate\Support\Facades\Hash;
+use App\Services\Ticket\RiskPoolService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use App\Exceptions\TicketOperationException;
 
 uses(RefreshDatabase::class);
 
@@ -75,6 +77,154 @@ test('admin risk pools index returns rows for draw', function (): void {
         ->assertJsonPath('data.items.0.is_sold_out', true);
 });
 
+test('admin risk pools index filters by number and high risk usage', function (): void {
+    $draw = Draw::query()->create([
+        'draw_no' => '20260512-004',
+        'business_date' => '2026-05-12',
+        'sequence_no' => 4,
+        'status' => 'open',
+        'start_time' => now()->subHour(),
+        'close_time' => now()->addHour(),
+        'draw_time' => now()->addHours(2),
+        'cooling_end_time' => null,
+        'result_source' => null,
+        'current_result_version' => 0,
+        'settle_version' => 0,
+        'is_reopened' => false,
+    ]);
+
+    RiskPool::query()->create([
+        'draw_id' => $draw->id,
+        'normalized_number' => '1288',
+        'total_cap_amount' => 1_000,
+        'locked_amount' => 850,
+        'remaining_amount' => 150,
+        'sold_out_status' => 0,
+        'version' => 1,
+    ]);
+
+    RiskPool::query()->create([
+        'draw_id' => $draw->id,
+        'normalized_number' => '5678',
+        'total_cap_amount' => 1_000,
+        'locked_amount' => 100,
+        'remaining_amount' => 900,
+        'sold_out_status' => 0,
+        'version' => 1,
+    ]);
+
+    $token = mintRiskAdminToken();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->getJson('/api/v1/admin/draws/'.$draw->id.'/risk-pools?high_risk_only=1')
+        ->assertOk()
+        ->assertJsonPath('data.meta.total', 1)
+        ->assertJsonPath('data.items.0.normalized_number', '1288');
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->getJson('/api/v1/admin/draws/'.$draw->id.'/risk-pools?normalized_number=67')
+        ->assertOk()
+        ->assertJsonPath('data.meta.total', 1)
+        ->assertJsonPath('data.items.0.normalized_number', '5678');
+});
+
+test('admin can manually close and recover a risk pool number', function (): void {
+    $draw = Draw::query()->create([
+        'draw_no' => '20260512-005',
+        'business_date' => '2026-05-12',
+        'sequence_no' => 5,
+        'status' => 'open',
+        'start_time' => now()->subHour(),
+        'close_time' => now()->addHour(),
+        'draw_time' => now()->addHours(2),
+        'cooling_end_time' => null,
+        'result_source' => null,
+        'current_result_version' => 0,
+        'settle_version' => 0,
+        'is_reopened' => false,
+    ]);
+
+    RiskPool::query()->create([
+        'draw_id' => $draw->id,
+        'normalized_number' => '2468',
+        'total_cap_amount' => 1_000,
+        'locked_amount' => 300,
+        'remaining_amount' => 700,
+        'sold_out_status' => 0,
+        'version' => 1,
+    ]);
+
+    $token = mintRiskAdminToken();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->postJson('/api/v1/admin/draws/'.$draw->id.'/risk-pools/2468/manual-close')
+        ->assertOk()
+        ->assertJsonPath('data.normalized_number', '2468')
+        ->assertJsonPath('data.is_sold_out', true)
+        ->assertJsonPath('data.version', 2);
+
+    $this->assertDatabaseHas('risk_pool_lock_logs', [
+        'draw_id' => $draw->id,
+        'normalized_number' => '2468',
+        'action_type' => 'close',
+        'amount' => 0,
+        'source_reason' => 'admin_manual_close',
+    ]);
+
+    expect(fn () => app(RiskPoolService::class)->preview($draw->id, [['number_4d' => '2468', 'amount' => 1]]))
+        ->toThrow(TicketOperationException::class, 'risk_sold_out');
+
+    expect(fn () => app(RiskPoolService::class)->acquire($draw->id, null, [['number_4d' => '2468', 'amount' => 1]]))
+        ->toThrow(TicketOperationException::class, 'risk_sold_out');
+});
+
+test('admin can recover a manually closed risk pool number', function (): void {
+    $draw = Draw::query()->create([
+        'draw_no' => '20260512-006',
+        'business_date' => '2026-05-12',
+        'sequence_no' => 6,
+        'status' => 'open',
+        'start_time' => now()->subHour(),
+        'close_time' => now()->addHour(),
+        'draw_time' => now()->addHours(2),
+        'cooling_end_time' => null,
+        'result_source' => null,
+        'current_result_version' => 0,
+        'settle_version' => 0,
+        'is_reopened' => false,
+    ]);
+
+    RiskPool::query()->create([
+        'draw_id' => $draw->id,
+        'normalized_number' => '2468',
+        'total_cap_amount' => 1_000,
+        'locked_amount' => 300,
+        'remaining_amount' => 700,
+        'sold_out_status' => 1,
+        'version' => 2,
+    ]);
+
+    $token = mintRiskAdminToken();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->postJson('/api/v1/admin/draws/'.$draw->id.'/risk-pools/2468/recover')
+        ->assertOk()
+        ->assertJsonPath('data.normalized_number', '2468')
+        ->assertJsonPath('data.is_sold_out', false)
+        ->assertJsonPath('data.version', 3);
+
+    $this->assertDatabaseHas('risk_pool_lock_logs', [
+        'draw_id' => $draw->id,
+        'normalized_number' => '2468',
+        'action_type' => 'recover',
+        'amount' => 0,
+        'source_reason' => 'admin_manual_recover',
+    ]);
+
+    expect(app(RiskPoolService::class)->acquire($draw->id, null, [['number_4d' => '2468', 'amount' => 1]]))
+        ->toBe(1);
+});
+
 test('admin risk pool lock logs include ticket_no when linked', function (): void {
     $draw = Draw::query()->create([
         'draw_no' => '20260512-002',