refactor：拆分 API 路由与请求校验，统一 final 类和代码风格

app/Http/Middleware/EnsureAdminApi.php

@@ -2,10 +2,10 @@
 
 namespace App\Http\Middleware;
 
-use App\Lottery\ErrorCode;
-use App\Models\AdminUser;
-use App\Support\ApiResponse;
 use Closure;
+use App\Models\AdminUser;
+use App\Lottery\ErrorCode;
+use App\Support\ApiResponse;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpFoundation\Response;
 
@@ -13,7 +13,7 @@ use Symfony\Component\HttpFoundation\Response;
  * 后台 API：`auth:sanctum` 之后执行，校验为 {@link AdminUser} 且未禁用；
  * 上下文可通过 `$request->lotteryAdmin()` 读取。
  */
-class EnsureAdminApi
+final class EnsureAdminApi
 {
     public function handle(Request $request, Closure $next): Response
     {

app/Http/Middleware/EnsureAdminPermission.php

@@ -2,10 +2,10 @@
 
 namespace App\Http\Middleware;
 
-use App\Lottery\ErrorCode;
-use App\Models\AdminUser;
-use App\Support\ApiResponse;
 use Closure;
+use App\Models\AdminUser;
+use App\Lottery\ErrorCode;
+use App\Support\ApiResponse;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpFoundation\Response;
 
@@ -13,7 +13,7 @@ use Symfony\Component\HttpFoundation\Response;
  * 后台 RBAC：在 {@see EnsureAdminApi} 之后校验 `prd.*` 等功能权限 slug（与 {@see AdminUser::hasAdminPermission} 一致）。
  * 路由参数支持 `slug` 或 `slug1|slug2`（满足其一即可）。
  */
-class EnsureAdminPermission
+final class EnsureAdminPermission
 {
     public function handle(Request $request, Closure $next, string $permissionSlugs): Response
     {

app/Http/Middleware/EnsurePlayerApi.php

@@ -2,14 +2,14 @@
 
 namespace App\Http\Middleware;
 
-use App\Exceptions\PlayerAuthenticationException;
-use App\Lottery\ErrorCode;
-use App\Services\PlayerTokenResolver;
-use App\Support\ApiResponse;
-use App\Support\LotteryMessage;
 use Closure;
+use App\Lottery\ErrorCode;
+use App\Support\ApiResponse;
 use Illuminate\Http\Request;
+use App\Support\LotteryMessage;
+use App\Services\PlayerTokenResolver;
 use Symfony\Component\HttpFoundation\Response;
+use App\Exceptions\PlayerAuthenticationException;
 
 /**
  * 【玩家端 API 鉴权中间件】
@@ -20,7 +20,7 @@ use Symfony\Component\HttpFoundation\Response;
  *
  * PlayerAuthenticationException 的 getMessage() 仅作开发与日志用语，可与 API msg 语种不一致。
  */
-class EnsurePlayerApi
+final class EnsurePlayerApi
 {
     public function handle(Request $request, Closure $next): Response
     {

app/Http/Middleware/NegotiateLotteryLocale.php

@@ -2,9 +2,9 @@
 
 namespace App\Http\Middleware;
 
-use App\Support\LotteryLocale;
 use Closure;
 use Illuminate\Http\Request;
+use App\Support\LotteryLocale;
 use Symfony\Component\HttpFoundation\Response;
 
 /**
@@ -20,7 +20,7 @@ use Symfony\Component\HttpFoundation\Response;
  *
  * 【与异常 JSON】{@see LotteryLocale} 与 middleware 同源，在未命中路由、`lottery_locale` 未写入时仍可从 Header 推导。
  */
-class NegotiateLotteryLocale
+final class NegotiateLotteryLocale
 {
     public function handle(Request $request, Closure $next): Response
     {