feat: 增强玩家管理功能，集成接入站点权限控制

在多个玩家相关控制器中引入 AdminSiteScope，确保管理员在执行操作前具备相应的接入站点权限。更新 Player 相关请求以支持 site_code 参数，增强权限验证逻辑，确保系统安全性与灵活性。同时，新增 AdminUser 模型方法以获取可访问的站点 ID 列表，优化权限管理。

app/Support/AdminSiteScope.php

@@ -0,0 +1,155 @@
+<?php
+
+namespace App\Support;
+
+use App\Models\AdminSite;
+use App\Models\AdminUser;
+use App\Models\Player;
+use App\Lottery\ErrorCode;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Http\JsonResponse;
+
+/**
+ * 后台站点数据范围：非超管仅可访问 {@see AdminUser::accessibleAdminSiteIds()} 绑定站点。
+ *
+ * 对应产品「site_only / site_all_data」；运行时以 admin_user_site_roles 为准（非已废弃的 admin_data_scopes 表）。
+ */
+final class AdminSiteScope
+{
+    /**
+     * @return list<string>|null `null` 表示不限制（超管）
+     */
+    public static function accessibleSiteCodes(AdminUser $admin): ?array
+    {
+        $siteIds = $admin->accessibleAdminSiteIds();
+        if ($siteIds === null) {
+            return null;
+        }
+
+        if ($siteIds === []) {
+            return [];
+        }
+
+        return AdminSite::query()
+            ->whereIn('id', $siteIds)
+            ->orderBy('code')
+            ->pluck('code')
+            ->map(static fn ($code): string => (string) $code)
+            ->values()
+            ->all();
+    }
+
+    public static function siteCodeAllowed(AdminUser $admin, string $siteCode): bool
+    {
+        $allowed = self::accessibleSiteCodes($admin);
+        if ($allowed === null) {
+            return true;
+        }
+
+        return in_array($siteCode, $allowed, true);
+    }
+
+    public static function playerAccessible(AdminUser $admin, Player $player): bool
+    {
+        return self::siteCodeAllowed($admin, (string) $player->site_code);
+    }
+
+    /**
+     * @param  Builder<Player>  $query
+     */
+    public static function applyToPlayerQuery(Builder $query, AdminUser $admin): void
+    {
+        $codes = self::accessibleSiteCodes($admin);
+        if ($codes === null) {
+            return;
+        }
+
+        if ($codes === []) {
+            $query->whereRaw('0 = 1');
+
+            return;
+        }
+
+        $query->whereIn('site_code', $codes);
+    }
+
+    /**
+     * 在站点范围基础上，可选按请求的 site_code 再收窄。
+     *
+     * @param  Builder<Player>  $query
+     */
+    public static function applyPlayerFilters(Builder $query, AdminUser $admin, ?string $requestedSiteCode): void
+    {
+        self::applyToPlayerQuery($query, $admin);
+
+        $siteCode = is_string($requestedSiteCode) ? trim($requestedSiteCode) : '';
+        if ($siteCode === '') {
+            return;
+        }
+
+        if (! self::siteCodeAllowed($admin, $siteCode)) {
+            $query->whereRaw('0 = 1');
+
+            return;
+        }
+
+        $query->where('site_code', $siteCode);
+    }
+
+    /**
+     * @param  Builder<mixed>  $query
+     */
+    public static function applyViaPlayerRelation(Builder $query, AdminUser $admin, string $relation = 'player'): void
+    {
+        $codes = self::accessibleSiteCodes($admin);
+        if ($codes === null) {
+            return;
+        }
+
+        if ($codes === []) {
+            $query->whereRaw('0 = 1');
+
+            return;
+        }
+
+        $query->whereHas($relation, static function (Builder $playerQuery) use ($codes): void {
+            $playerQuery->whereIn('site_code', $codes);
+        });
+    }
+
+    /**
+     * @param  Builder<mixed>  $query
+     */
+    public static function applyViaPlayerRelationWithSiteCode(
+        Builder $query,
+        AdminUser $admin,
+        ?string $requestedSiteCode,
+        string $relation = 'player',
+    ): void {
+        self::applyViaPlayerRelation($query, $admin, $relation);
+
+        $siteCode = is_string($requestedSiteCode) ? trim($requestedSiteCode) : '';
+        if ($siteCode === '') {
+            return;
+        }
+
+        if (! self::siteCodeAllowed($admin, $siteCode)) {
+            $query->whereRaw('0 = 1');
+
+            return;
+        }
+
+        $query->whereHas($relation, static function (Builder $playerQuery) use ($siteCode): void {
+            $playerQuery->where('site_code', $siteCode);
+        });
+    }
+
+    public static function denyUnlessPlayerAccessible(AdminUser $admin, Player $player): ?JsonResponse
+    {
+        if (! self::playerAccessible($admin, $player)) {
+            return ApiResponse::error('无权访问该站点下的玩家', ErrorCode::AdminForbidden->value, null, 403);
+        }
+
+        return null;
+    }
+}