feat: 增强管理员 API 鉴权，新增 token 有效天数配置，更新相关异常处理与错误码引用

tests/Feature/PlayerFoundationTest.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Lottery\ErrorCode;
 use App\Models\Player;
 use Firebase\JWT\JWT;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -20,25 +21,26 @@ test('player me returns profile with dev bearer', function () {
     $this->withHeader('Authorization', 'Bearer dev:'.$player->id)
         ->getJson('/api/v1/player/me')
         ->assertOk()
-        ->assertJsonPath('code', 0)
+        ->assertJsonPath('code', ErrorCode::Success->value)
         ->assertJsonPath('data.id', $player->id)
         ->assertJsonPath('data.site_player_id', 'uid-42')
         ->assertJsonPath('data.username', 'alice');
 });
 
 test('player auth missing bearer returns localized sso 8001', function () {
+    $code = ErrorCode::PlayerAuthorizationInvalid->value;
     $this->withHeader('Accept-Language', 'zh-CN,zh;q=0.9')
         ->getJson('/api/v1/player/me')
         ->assertStatus(Response::HTTP_UNAUTHORIZED)
-        ->assertJsonPath('code', 8001)
-        ->assertJsonPath('msg', __('sso.8001', [], 'zh'));
+        ->assertJsonPath('code', $code)
+        ->assertJsonPath('msg', __("sso.$code", [], 'zh'));
 });
 
 test('api unknown route returns unified not_found json without hitting locale middleware', function () {
     $this->withHeader('X-Locale', 'zh')
         ->getJson('/api/v1/player/__no_route__xxx')
         ->assertStatus(Response::HTTP_NOT_FOUND)
-        ->assertJsonPath('code', 9004)
+        ->assertJsonPath('code', ErrorCode::NotFound->value)
         ->assertJsonPath('msg', __('api.not_found', [], 'zh'));
 });