feat(agent-profile): 限制代理及玩家返点和分成范围，增强权限校验

- 添加ensureSuperAdmin方法，限制管理员设置操作权限
- 在AdminSettingController接口中新增权限检查，防止非超级管理员操作
- AdminPlayerIndexController新增direct agent筛选支持
- AdminPlayerUpdateController新增对信用玩家默认币别变更的拒绝逻辑
- 新增WalletSettlementBillsController，实现玩家信用盘账期账单摘要接口
- AgentProfileService调整，新增返点限额和分享比例自动下调机制，保持子代理及玩家配置不超父级
- AgentProfileService增加can_grant_extra_rebate权限继承限制，阻止无权限代理开启
- AgentSettlementPeriodCloseService增加玩家账单回水信用释放逻辑，确保信用额度同步
- PlayerCreditService新增释放账单回水对应信用逻辑，维护账期信用一致性
- TicketPlacementService和TicketPreviewService新增信用玩家投注币别匹配校验，防止币别不符
- PlayerLedgerLogsService优化信用额度计算，增加可用额度上下限限制，防止负值和超限
- 调整后台管理导航，仅超管可见设置入口，强化权限隔离
- 路由新增玩家信用账单查询接口
- 补充多项AgentProfile相关单元测试覆盖额度限制、返点继承、返点下调场景及权限限制
- 增加站点管理员登录测试，验证系统设置菜单不可见，提升用户权限体验

tests/Feature/AdminPlayerManageApiTest.php

@@ -237,6 +237,60 @@ test('player manage permission gates write and freeze APIs separately from view
         ->assertOk();
 });
 
+test('agent players list can filter direct players without including downline players', function (): void {
+    $siteId = (int) DB::table('admin_sites')->where('is_default', true)->value('id');
+    $siteCode = (string) DB::table('admin_sites')->where('id', $siteId)->value('code');
+    $rootId = (int) DB::table('agent_nodes')->where('admin_site_id', $siteId)->where('depth', 0)->value('id');
+
+    $super = AdminUser::query()->create([
+        'username' => 'direct_player_super',
+        'name' => 'Direct Player Super',
+        'email' => null,
+        'password' => Hash::make('secret-strong'),
+        'status' => 0,
+    ]);
+    grantSuperAdminRole($super);
+
+    $child = app(\App\Services\Agent\AgentNodeService::class)->createChild($super, [
+        'parent_id' => $rootId,
+        'code' => 'direct-child',
+        'name' => 'Direct Child',
+    ]);
+
+    $rootPlayer = Player::query()->create([
+        'site_code' => $siteCode,
+        'agent_node_id' => $rootId,
+        'site_player_id' => 'direct-root-player',
+        'username' => 'direct_root_player',
+        'default_currency' => 'NPR',
+        'status' => 0,
+    ]);
+    $childPlayer = Player::query()->create([
+        'site_code' => $siteCode,
+        'agent_node_id' => $child->id,
+        'site_player_id' => 'direct-child-player',
+        'username' => 'direct_child_player',
+        'default_currency' => 'NPR',
+        'status' => 0,
+    ]);
+
+    $token = playerManageAdminToken();
+
+    $rootResponse = $this->withHeader('Authorization', 'Bearer '.$token)
+        ->getJson('/api/v1/admin/players?site_code='.$siteCode.'&agent_node_id='.$rootId.'&agent_scope=direct');
+
+    $rootResponse->assertOk()->assertJsonPath('data.meta.total', 1);
+    $rootIds = collect($rootResponse->json('data.items'))->pluck('id')->map(static fn ($id): int => (int) $id);
+    expect($rootIds)->toContain($rootPlayer->id)->not->toContain($childPlayer->id);
+
+    $childResponse = $this->withHeader('Authorization', 'Bearer '.$token)
+        ->getJson('/api/v1/admin/players?site_code='.$siteCode.'&agent_node_id='.$child->id.'&agent_scope=direct');
+
+    $childResponse->assertOk()->assertJsonPath('data.meta.total', 1);
+    $childIds = collect($childResponse->json('data.items'))->pluck('id')->map(static fn ($id): int => (int) $id);
+    expect($childIds)->toContain($childPlayer->id)->not->toContain($rootPlayer->id);
+});
+
 test('admin can update player default currency and validation rejects unknown code', function (): void {
     $player = Player::query()->create([
         'site_code' => 'main',
@@ -244,6 +298,7 @@ test('admin can update player default currency and validation rejects unknown co
         'username' => 'currency_user',
         'nickname' => 'Currency',
         'default_currency' => 'NPR',
+        'funding_mode' => PlayerFundingMode::WALLET,
         'status' => 0,
     ]);
 
@@ -268,6 +323,46 @@ test('admin can update player default currency and validation rejects unknown co
         ->assertStatus(422);
 });
 
+test('admin cannot change credit player default currency', function (): void {
+    $siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
+    $siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';
+    $rootId = (int) DB::table('agent_nodes')->where('depth', 0)->value('id');
+
+    $player = Player::query()->create([
+        'site_code' => $siteCode,
+        'agent_node_id' => $rootId,
+        'site_player_id' => 'credit-currency-locked-1',
+        'auth_source' => PlayerAuthSource::LOTTERY_NATIVE,
+        'funding_mode' => PlayerFundingMode::CREDIT,
+        'username' => 'credit_currency_locked',
+        'default_currency' => 'NPR',
+        'status' => 0,
+    ]);
+
+    DB::table('player_credit_accounts')->insert([
+        'player_id' => $player->id,
+        'credit_limit' => 500,
+        'used_credit' => 120,
+        'frozen_credit' => 0,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $token = playerManageAdminToken();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->putJson('/api/v1/admin/players/'.$player->id, [
+            'default_currency' => 'USD',
+        ])
+        ->assertStatus(422)
+        ->assertJsonPath('code', \App\Lottery\ErrorCode::ValidationFailed->value);
+
+    $this->assertDatabaseHas('players', [
+        'id' => $player->id,
+        'default_currency' => 'NPR',
+    ]);
+});
+
 test('admin can set player credit limit without clobbering used credit', function (): void {
     $siteCode = DB::table('admin_sites')->where('is_default', true)->value('code');
     $siteCode = is_string($siteCode) && $siteCode !== '' ? $siteCode : 'default_site';