feat(agent-profile): 限制代理及玩家返点和分成范围，增强权限校验

- 添加ensureSuperAdmin方法，限制管理员设置操作权限
- 在AdminSettingController接口中新增权限检查，防止非超级管理员操作
- AdminPlayerIndexController新增direct agent筛选支持
- AdminPlayerUpdateController新增对信用玩家默认币别变更的拒绝逻辑
- 新增WalletSettlementBillsController，实现玩家信用盘账期账单摘要接口
- AgentProfileService调整，新增返点限额和分享比例自动下调机制，保持子代理及玩家配置不超父级
- AgentProfileService增加can_grant_extra_rebate权限继承限制，阻止无权限代理开启
- AgentSettlementPeriodCloseService增加玩家账单回水信用释放逻辑，确保信用额度同步
- PlayerCreditService新增释放账单回水对应信用逻辑，维护账期信用一致性
- TicketPlacementService和TicketPreviewService新增信用玩家投注币别匹配校验，防止币别不符
- PlayerLedgerLogsService优化信用额度计算，增加可用额度上下限限制，防止负值和超限
- 调整后台管理导航，仅超管可见设置入口，强化权限隔离
- 路由新增玩家信用账单查询接口
- 补充多项AgentProfile相关单元测试覆盖额度限制、返点继承、返点下调场景及权限限制
- 增加站点管理员登录测试，验证系统设置菜单不可见，提升用户权限体验

tests/Feature/TicketBettingApiTest.php

@@ -1033,6 +1033,61 @@ test('credit player ticket preview shows period rebate estimate without instant
         ->assertJsonPath('data.lines.0.actual_deduct_amount', 10_000);
 });
 
+test('credit player preview and place reject non default currency', function (): void {
+    $site = DB::table('admin_sites')->where('is_default', true)->first();
+    $rootId = (int) DB::table('agent_nodes')->where('depth', 0)->value('id');
+
+    $player = Player::query()->create([
+        'site_code' => (string) $site->code,
+        'agent_node_id' => $rootId,
+        'site_player_id' => 'native:credit-currency-mismatch',
+        'auth_source' => 'lottery_native',
+        'funding_mode' => 'credit',
+        'username' => 'credit_currency_user',
+        'password_hash' => bcrypt('secret-pass'),
+        'nickname' => null,
+        'default_currency' => 'NPR',
+        'status' => 0,
+    ]);
+
+    DB::table('player_credit_accounts')->insert([
+        'player_id' => $player->id,
+        'credit_limit' => 500_000,
+        'used_credit' => 0,
+        'frozen_credit' => 0,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    ticketOpenDraw('20260511-credit-currency');
+
+    $payload = [
+        'draw_id' => '20260511-credit-currency',
+        'currency_code' => 'USD',
+        'client_trace_id' => 'trace-credit-currency-mismatch',
+        'lines' => [
+            ['number' => '12', 'play_code' => 'pos_2a', 'amount' => 10_000],
+        ],
+    ];
+
+    $this->withHeader('Authorization', 'Bearer dev:'.$player->id)
+        ->postJson('/api/v1/ticket/preview', $payload)
+        ->assertStatus(400)
+        ->assertJsonPath('code', ErrorCode::ConfigCurrencyInvalid->value)
+        ->assertJsonPath('data.currency_code', 'USD')
+        ->assertJsonPath('data.expected_currency', 'NPR');
+
+    $this->withHeader('Authorization', 'Bearer dev:'.$player->id)
+        ->postJson('/api/v1/ticket/place', $payload)
+        ->assertStatus(400)
+        ->assertJsonPath('code', ErrorCode::ConfigCurrencyInvalid->value)
+        ->assertJsonPath('data.currency_code', 'USD')
+        ->assertJsonPath('data.expected_currency', 'NPR');
+
+    expect(TicketOrder::query()->where('player_id', $player->id)->exists())->toBeFalse()
+        ->and(DB::table('credit_ledger')->where('owner_id', $player->id)->exists())->toBeFalse();
+});
+
 test('ticket pending confirmation reconcile releases risk when wallet deduction is missing', function (): void {
     $draw = ticketOpenDraw();
     $player = ticketPlayerWithWallet();