feat: 增强代理和玩家管理功能

- 在多个控制器中更新权限检查逻辑，确保管理员能够更灵活地管理代理和玩家。
- 在 AdminPlayerStoreController 中引入对玩家创建能力的验证，确保只有具备相应权限的管理员能够创建玩家。
- 更新请求验证逻辑，新增 credit_limit、rebate_rate 和 extra_rebate_rate 字段，以支持更细粒度的玩家管理。
- 在 AgentNodeProfileController 中添加对父代理能力授予的验证，确保子代理的权限在父代理范围内。
- 引入 AgentProfileFieldRules 以简化代理资料更新请求的规则定义，提升代码复用性。

app/Http/Controllers/Api/V1/Admin/Agent/AgentLineStoreController.php

@@ -26,7 +26,7 @@ final class AgentLineStoreController extends Controller
         $site = $result['site'];
         $node = $result['agent_node'];
 
-        $payload = AgentLinePresenter::provisioned($site, $node, $result['secrets']);
+        $payload = AgentLinePresenter::provisioned($site, $node);
 
         AuditLogger::recordForAdmin(
             $admin,

app/Http/Controllers/Api/V1/Admin/Agent/AgentNodeChildrenController.php

@@ -3,6 +3,7 @@
 namespace App\Http\Controllers\Api\V1\Admin\Agent;
 
 use App\Models\AgentNode;
+use App\Models\AgentProfile;
 use App\Support\ApiResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\JsonResponse;
@@ -22,10 +23,21 @@ final class AgentNodeChildrenController extends Controller
             return $denied;
         }
 
-        $items = $agent_node->children()
-            ->orderBy('code')
+        $children = $agent_node->children()->orderBy('code')->get();
+        $profiles = AgentProfile::query()
+            ->whereIn('agent_node_id', $children->pluck('id'))
             ->get()
-            ->map(static fn (AgentNode $child): array => AgentNodePresenter::item($child))
+            ->keyBy('agent_node_id');
+
+        $items = $children
+            ->map(static function (AgentNode $child) use ($profiles): array {
+                $profile = $profiles->get($child->id);
+
+                return AgentNodePresenter::item(
+                    $child,
+                    $profile instanceof AgentProfile ? $profile : null,
+                );
+            })
             ->all();
 
         return ApiResponse::success(['items' => $items]);

app/Http/Controllers/Api/V1/Admin/Agent/AgentNodeProfileController.php

@@ -3,11 +3,12 @@
 namespace App\Http\Controllers\Api\V1\Admin\Agent;
 
 use App\Http\Controllers\Controller;
+use App\Http\Middleware\RecordAdminApiAudit;
 use App\Http\Requests\Admin\AdminAgentProfileUpdateRequest;
 use App\Models\AgentNode;
 use App\Models\AgentProfile;
-use App\Services\Agent\AgentNodeService;
 use App\Services\Agent\AgentProfileService;
+use App\Services\AuditLogger;
 use App\Support\AdminAgentScope;
 use App\Support\ApiResponse;
 use Illuminate\Http\JsonResponse;
@@ -22,20 +23,28 @@ final class AgentNodeProfileController extends Controller
         abort_if($admin === null, 401);
         abort_if(! AdminAgentScope::nodeVisibleTo($admin, $agent_node), 403);
 
+        $service = app(AgentProfileService::class);
         $profile = AgentProfile::query()->firstOrNew(['agent_node_id' => $agent_node->id]);
+        $parent = $agent_node->parent_id !== null
+            ? AgentNode::query()->find($agent_node->parent_id)
+            : null;
 
-        return ApiResponse::success(app(AgentProfileService::class)->present($profile));
+        return ApiResponse::success([
+            ...$service->present($profile),
+            'parent_caps' => $service->parentCapsForNode($parent),
+            'risk_tags' => $agent_node->risk_tags ?? [],
+        ]);
     }
 
     public function update(
         AdminAgentProfileUpdateRequest $request,
         AgentNode $agent_node,
         AgentProfileService $service,
-        AgentNodeService $agentNodeService,
     ): JsonResponse {
         $admin = $request->lotteryAdmin();
         abort_if($admin === null, 401);
         abort_if(! AdminAgentScope::nodeVisibleTo($admin, $agent_node), 403);
+        abort_if(! AdminAgentScope::nodeProfileEditableBy($admin, $agent_node), 403);
 
         $parent = $agent_node->parent_id !== null
             ? AgentNode::query()->find($agent_node->parent_id)
@@ -46,9 +55,33 @@ final class AgentNodeProfileController extends Controller
             $service->assertChildCapabilityGrantsWithinParent($parent, $payload, $admin);
         }
 
-        $profile = $service->upsertForNode($agent_node, $payload, $parent);
-        $agentNodeService->syncPrimaryOwnerRoleFromProfile($agent_node, $profile);
+        $beforeProfile = AgentProfile::query()->where('agent_node_id', $agent_node->id)->first();
+        $beforeJson = $beforeProfile !== null ? $service->present($beforeProfile) : [];
 
-        return ApiResponse::success($service->present($profile));
+        if ($request->has('risk_tags')) {
+            $agent_node->risk_tags = array_values(array_unique(array_filter(
+                array_map('strval', $request->input('risk_tags', [])),
+            )));
+            $agent_node->save();
+        }
+
+        $profile = $service->upsertForNode($agent_node, $payload, $parent);
+        $afterJson = array_merge($service->present($profile), [
+            'risk_tags' => $agent_node->risk_tags ?? [],
+        ]);
+
+        AuditLogger::recordForAdmin(
+            $admin,
+            $request,
+            moduleCode: 'agent',
+            actionCode: 'agent_profile.update',
+            targetType: 'agent_node',
+            targetId: (string) $agent_node->id,
+            beforeJson: $beforeJson,
+            afterJson: $afterJson,
+        );
+        $request->attributes->set(RecordAdminApiAudit::ATTRIBUTE_AUDIT_RECORDED, true);
+
+        return ApiResponse::success($afterJson);
     }
 }