feat: 添加 JWT 支持与开发环境配置，更新 API 路由与中间件

app/Http/Controllers/Api/V1/Admin/PingController.php

@@ -6,7 +6,10 @@ use App\Http\Controllers\Controller;
 use App\Support\ApiResponse;
 use Illuminate\Http\JsonResponse;
 
-/** 探路由用，上线前可删除或改为需登录 */
+/**
+ * 无需登录（当前 admin 中间件为直通）：确认 `/api/v1/admin` 前缀可达。
+ * 路由：GET /api/v1/admin/ping
+ */
 class PingController extends Controller
 {
     public function __invoke(): JsonResponse

app/Http/Controllers/Api/V1/HealthController.php

@@ -10,6 +10,8 @@ class HealthController extends Controller
 {
     /**
      * 健康检查（Next / 网关探活）。路径：GET /api/v1/health
+     *
+     * 非调试环境不返回框架版本号，避免信息泄露。
      */
     public function __invoke(): JsonResponse
     {
@@ -19,7 +21,7 @@ class HealthController extends Controller
         ];
 
         if (config('app.debug')) {
-            $payload['laravel'] = app()->version();
+            $payload['laravel'] = app()->version(); // 仅本地/调试
         }
 
         return ApiResponse::success($payload);

app/Http/Controllers/Api/V1/Player/MeController.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Player;
+
+use App\Http\Controllers\Controller;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/**
+ * 鉴权自检：返回当前 Token 对应的玩家公开字段（不含密码）。
+ *
+ * 路由：GET /api/v1/player/me ，需 middleware lottery.player。
+ */
+class MeController extends Controller
+{
+    public function __invoke(Request $request): JsonResponse
+    {
+        $player = $request->lotteryPlayer();
+        // 理论上不会为 null（路由已套 EnsurePlayerApi）；保留断言便于排查配置错误
+        abort_if($player === null, 500, 'lottery_player missing');
+
+        return ApiResponse::success([
+            'id' => $player->id,
+            'site_code' => $player->site_code,
+            'site_player_id' => $player->site_player_id,
+            'username' => $player->username,
+            'nickname' => $player->nickname,
+            'default_currency' => $player->default_currency,
+            'status' => $player->status,
+        ]);
+    }
+}

app/Http/Controllers/Api/V1/Player/PingController.php

@@ -6,7 +6,10 @@ use App\Http\Controllers\Controller;
 use App\Support\ApiResponse;
 use Illuminate\Http\JsonResponse;
 
-/** 探路由用，上线前可删除或改为需登录 */
+/**
+ * 无需登录：仅供网关/前端确认「玩家 API 前缀」可达。
+ * 路由：GET /api/v1/player/ping
+ */
 class PingController extends Controller
 {
     public function __invoke(): JsonResponse