feat(agent-profile): 限制代理及玩家返点和分成范围，增强权限校验

- 添加ensureSuperAdmin方法，限制管理员设置操作权限
- 在AdminSettingController接口中新增权限检查，防止非超级管理员操作
- AdminPlayerIndexController新增direct agent筛选支持
- AdminPlayerUpdateController新增对信用玩家默认币别变更的拒绝逻辑
- 新增WalletSettlementBillsController，实现玩家信用盘账期账单摘要接口
- AgentProfileService调整，新增返点限额和分享比例自动下调机制，保持子代理及玩家配置不超父级
- AgentProfileService增加can_grant_extra_rebate权限继承限制，阻止无权限代理开启
- AgentSettlementPeriodCloseService增加玩家账单回水信用释放逻辑，确保信用额度同步
- PlayerCreditService新增释放账单回水对应信用逻辑，维护账期信用一致性
- TicketPlacementService和TicketPreviewService新增信用玩家投注币别匹配校验，防止币别不符
- PlayerLedgerLogsService优化信用额度计算，增加可用额度上下限限制，防止负值和超限
- 调整后台管理导航，仅超管可见设置入口，强化权限隔离
- 路由新增玩家信用账单查询接口
- 补充多项AgentProfile相关单元测试覆盖额度限制、返点继承、返点下调场景及权限限制
- 增加站点管理员登录测试，验证系统设置菜单不可见，提升用户权限体验

tests/Feature/AdminSettingBatchUpdateTest.php

@@ -4,6 +4,7 @@ use App\Models\AdminRole;
 use App\Models\AdminUser;
 use App\Models\LotterySetting;
 use App\Services\LotterySettings;
+use App\Support\SitePlatformRole;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 
@@ -22,24 +23,7 @@ function settingsAdminToken(): string
         'password' => Hash::make('secret-strong'),
         'status' => 0,
     ]);
-
-    $role = AdminRole::query()->create([
-        'slug' => 'settings_role',
-        'name' => 'Settings Role',
-    ]);
-    $role->syncLegacyPermissionSlugs([
-        'prd.payout.manage',
-        'prd.draw_result.manage',
-        'prd.wallet_reconcile.manage',
-        'prd.rebate.manage',
-    ]);
-
-    $admin->roles()->sync([
-        (int) $role->id => [
-            'site_id' => AdminUser::defaultAdminSiteId(),
-            'granted_at' => now(),
-        ],
-    ]);
+    grantSuperAdminRole($admin);
 
     return $admin->createToken('test', ['*'], now()->addDay())->plainTextToken;
 }
@@ -70,6 +54,26 @@ function settingsReadOnlyToken(): string
     return $admin->createToken('test', ['*'], now()->addDay())->plainTextToken;
 }
 
+function settingsSiteAdminToken(): string
+{
+    $admin = AdminUser::query()->create([
+        'username' => 'settings_site_admin',
+        'name' => 'Settings Site Admin',
+        'email' => null,
+        'password' => Hash::make('secret-strong'),
+        'status' => 0,
+    ]);
+
+    $admin->roles()->sync([
+        SitePlatformRole::id() => [
+            'site_id' => AdminUser::defaultAdminSiteId(),
+            'granted_at' => now(),
+        ],
+    ]);
+
+    return $admin->createToken('test', ['*'], now()->addDay())->plainTextToken;
+}
+
 test('admin can batch update settings in one request', function (): void {
     LotterySettings::put('draw.cooldown_minutes', 15, 'draw');
     LotterySettings::put('draw.require_manual_review', true, 'draw');
@@ -124,6 +128,35 @@ test('admin settings deployment returns read only snapshot', function (): void {
         ->assertJsonFragment(['key' => 'draw.interval_minutes', 'value' => 7]);
 });
 
+test('site admin cannot access system settings endpoints', function (): void {
+    LotterySettings::put('frontend.play_rules_html_zh', '<div>old</div>', 'frontend');
+    $token = settingsSiteAdminToken();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->getJson('/api/v1/admin/settings')
+        ->assertForbidden();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->getJson('/api/v1/admin/settings/deployment')
+        ->assertForbidden();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->putJson('/api/v1/admin/settings/frontend.play_rules_html_zh', [
+            'value' => '<div>new</div>',
+        ])
+        ->assertForbidden();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->putJson('/api/v1/admin/settings/batch', [
+            'items' => [
+                ['key' => 'frontend.play_rules_html_zh', 'value' => '<div>new</div>'],
+            ],
+        ])
+        ->assertForbidden();
+
+    expect(LotterySetting::query()->where('setting_key', 'frontend.play_rules_html_zh')->value('value_json'))->toBe('<div>old</div>');
+});
+
 test('admin settings batch update rejects empty items', function (): void {
     $token = settingsAdminToken();
 
@@ -232,7 +265,7 @@ test('wallet max limit cannot be less than current min limit', function (): void
     expect(LotterySetting::query()->where('setting_key', 'wallet.transfer_in_max_minor')->value('value_json'))->toBe(10_000);
 });
 
-test('settings updates require permission for their setting group', function (): void {
+test('non super admin cannot update settings even with setting related permissions', function (): void {
     LotterySettings::put('draw.cooldown_minutes', 15, 'draw');
     LotterySettings::put('frontend.play_rules_html_zh', '<div>old</div>', 'frontend');
 
@@ -248,8 +281,8 @@ test('settings updates require permission for their setting group', function ():
         ->putJson('/api/v1/admin/settings/frontend.play_rules_html_zh', [
             'value' => '<div>new</div>',
         ])
-        ->assertOk();
+        ->assertForbidden();
 
     expect(LotterySetting::query()->where('setting_key', 'draw.cooldown_minutes')->value('value_json'))->toBe(15)
-        ->and(LotterySetting::query()->where('setting_key', 'frontend.play_rules_html_zh')->value('value_json'))->toBe('<div>new</div>');
+        ->and(LotterySetting::query()->where('setting_key', 'frontend.play_rules_html_zh')->value('value_json'))->toBe('<div>old</div>');
 });