feat: 增强管理员权限管理，添加 RBAC 支持，更新 AdminUser 模型以处理角色和权限，更新登录接口返回权限信息，扩展数据库填充器以同步角色权限

app/Http/Controllers/Api/V1/Admin/Audit/AuditLogIndexController.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Audit;
+
+use App\Http\Controllers\Controller;
+use App\Models\AuditLog;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/**
+ * GET /api/v1/admin/audit-logs — 运营/客服查询审计留痕。
+ */
+final class AuditLogIndexController extends Controller
+{
+    public function __invoke(Request $request): JsonResponse
+    {
+        $perPage = min(max((int) $request->integer('per_page', 25), 1), 100);
+        $page = max((int) $request->integer('page', 1), 1);
+        $module = trim((string) $request->query('module_code', ''));
+        $action = trim((string) $request->query('action_code', ''));
+        $operatorType = trim((string) $request->query('operator_type', ''));
+
+        $q = AuditLog::query()->orderByDesc('id');
+
+        if ($module !== '') {
+            $q->where('module_code', $module);
+        }
+        if ($action !== '') {
+            $q->where('action_code', $action);
+        }
+        if ($operatorType !== '') {
+            $q->where('operator_type', $operatorType);
+        }
+
+        $paginator = $q->paginate($perPage, ['*'], 'page', $page);
+
+        return ApiResponse::success([
+            'items' => collect($paginator->items())->map(fn (AuditLog $r) => $this->row($r))->all(),
+            'meta' => [
+                'current_page' => $paginator->currentPage(),
+                'per_page' => $paginator->perPage(),
+                'total' => $paginator->total(),
+                'last_page' => $paginator->lastPage(),
+            ],
+        ]);
+    }
+
+    /** @return array<string, mixed> */
+    private function row(AuditLog $r): array
+    {
+        return [
+            'id' => (int) $r->id,
+            'operator_type' => $r->operator_type,
+            'operator_id' => (int) $r->operator_id,
+            'module_code' => $r->module_code,
+            'action_code' => $r->action_code,
+            'target_type' => $r->target_type,
+            'target_id' => $r->target_id,
+            'before_json' => $r->before_json,
+            'after_json' => $r->after_json,
+            'ip' => $r->ip,
+            'user_agent' => $r->user_agent,
+            'created_at' => $r->created_at?->toIso8601String(),
+        ];
+    }
+}

app/Http/Controllers/Api/V1/Admin/Auth/LoginController.php

@@ -87,6 +87,7 @@ final class LoginController
                 'username' => $admin->username,
                 'nickname' => $admin->name,
                 'email' => $admin->email,
+                'permissions' => $admin->fresh()->adminPermissionSlugs(),
             ],
         ]);
     }

app/Http/Controllers/Api/V1/Admin/Draw/AdminDrawFinanceSummaryController.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Draw;
+
+use App\Http\Controllers\Controller;
+use App\Models\Draw;
+use App\Models\SettlementBatch;
+use App\Models\TicketItem;
+use App\Models\TicketOrder;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+
+/**
+ * GET /api/v1/admin/draws/{draw}/finance-summary — 单期投注/派彩汇总（客服/财务视角，PRD §15.4）。
+ *
+ * 口径：以订单实扣汇总为「当期投注」；以注项中奖+Jackpot 为「当期派彩」；差额为近似毛损益（不含回水等细项）。
+ */
+final class AdminDrawFinanceSummaryController extends Controller
+{
+    public function __invoke(Draw $draw): JsonResponse
+    {
+        $drawId = (int) $draw->id;
+
+        $totalBetMinor = (int) TicketOrder::query()->where('draw_id', $drawId)->sum('total_actual_deduct');
+        $orderCount = (int) TicketOrder::query()->where('draw_id', $drawId)->count();
+        $itemCount = (int) TicketItem::query()->where('draw_id', $drawId)->count();
+
+        $currencyCode = (string) (TicketOrder::query()
+            ->where('draw_id', $drawId)
+            ->value('currency_code') ?? '');
+
+        $totalWinMinor = (int) TicketItem::query()->where('draw_id', $drawId)->sum('win_amount');
+        $totalJackpotWinMinor = (int) TicketItem::query()->where('draw_id', $drawId)->sum('jackpot_win_amount');
+        $totalPayoutMinor = $totalWinMinor + $totalJackpotWinMinor;
+        $approxHouseGrossMinor = $totalBetMinor - $totalPayoutMinor;
+
+        $batches = SettlementBatch::query()
+            ->where('draw_id', $drawId)
+            ->orderByDesc('id')
+            ->limit(30)
+            ->get(['id', 'status', 'total_ticket_count', 'total_win_count', 'total_payout_amount', 'total_jackpot_payout_amount', 'finished_at']);
+
+        $batchRows = $batches->map(static function (SettlementBatch $b): array {
+            return [
+                'id' => (int) $b->id,
+                'status' => $b->status,
+                'total_ticket_count' => (int) $b->total_ticket_count,
+                'total_win_count' => (int) $b->total_win_count,
+                'total_payout_amount' => (int) $b->total_payout_amount,
+                'total_jackpot_payout_amount' => (int) $b->total_jackpot_payout_amount,
+                'finished_at' => $b->finished_at?->toIso8601String(),
+            ];
+        })->values()->all();
+
+        return ApiResponse::success([
+            'draw_id' => $drawId,
+            'draw_no' => $draw->draw_no,
+            'draw_status' => $draw->status,
+            'currency_code' => $currencyCode !== '' ? $currencyCode : null,
+            'order_count' => $orderCount,
+            'ticket_item_count' => $itemCount,
+            'total_bet_minor' => $totalBetMinor,
+            'total_win_payout_minor' => $totalWinMinor,
+            'total_jackpot_win_minor' => $totalJackpotWinMinor,
+            'total_payout_minor' => $totalPayoutMinor,
+            'approx_house_gross_minor' => $approxHouseGrossMinor,
+            'settlement_batches' => $batchRows,
+        ]);
+    }
+}

app/Http/Controllers/Api/V1/Admin/Player/AdminPlayerTicketItemsIndexController.php

@@ -0,0 +1,74 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Player;
+
+use App\Http\Controllers\Controller;
+use App\Models\Player;
+use App\Models\TicketItem;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/**
+ * GET /api/v1/admin/players/{player}/ticket-items — 客服/财务按玩家查注单（PRD §15.4）。
+ *
+ * Query：`page`、`per_page`（最大 50）、`draw_no`（可选，精确期号）。
+ */
+final class AdminPlayerTicketItemsIndexController extends Controller
+{
+    public function __invoke(Request $request, Player $player): JsonResponse
+    {
+        $validated = validator($request->query(), [
+            'page' => ['sometimes', 'integer', 'min:1'],
+            'per_page' => ['sometimes', 'integer', 'min:1', 'max:50'],
+            'draw_no' => ['sometimes', 'nullable', 'string', 'max:32'],
+        ])->validate();
+
+        $perPage = max(1, min(50, (int) ($validated['per_page'] ?? 20)));
+        $page = max(1, (int) ($validated['page'] ?? 1));
+        $drawNo = isset($validated['draw_no']) ? trim((string) $validated['draw_no']) : '';
+
+        $query = TicketItem::query()
+            ->where('ticket_items.player_id', $player->id)
+            ->with([
+                'draw:id,draw_no,business_date',
+                'order:id,order_no,currency_code,created_at',
+            ])
+            ->orderByDesc('ticket_items.id');
+
+        if ($drawNo !== '') {
+            $query->whereHas('draw', fn ($q) => $q->where('draw_no', $drawNo));
+        }
+
+        $paginator = $query->paginate(perPage: $perPage, page: $page, columns: ['*']);
+
+        $items = collect($paginator->items())->map(function (TicketItem $row): array {
+            return [
+                'ticket_no' => $row->ticket_no,
+                'order_no' => $row->order?->order_no,
+                'draw_no' => $row->draw?->draw_no,
+                'currency_code' => $row->order?->currency_code,
+                'play_code' => $row->play_code,
+                'original_number' => $row->original_number,
+                'total_bet_amount' => (int) $row->total_bet_amount,
+                'actual_deduct_amount' => (int) $row->actual_deduct_amount,
+                'status' => $row->status,
+                'fail_reason_code' => $row->fail_reason_code,
+                'fail_reason_text' => $row->fail_reason_text,
+                'win_amount' => (int) $row->win_amount,
+                'jackpot_win_amount' => (int) $row->jackpot_win_amount,
+                'placed_at' => $row->order?->created_at?->toIso8601String(),
+                'updated_at' => $row->updated_at?->toIso8601String(),
+            ];
+        })->values()->all();
+
+        return ApiResponse::success([
+            'player_id' => (int) $player->id,
+            'items' => $items,
+            'total' => $paginator->total(),
+            'page' => $paginator->currentPage(),
+            'per_page' => $paginator->perPage(),
+            'last_page' => $paginator->lastPage(),
+        ]);
+    }
+}

app/Http/Controllers/Api/V1/Admin/Reconcile/ReconcileItemIndexController.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Reconcile;
+
+use App\Http\Controllers\Controller;
+use App\Models\ReconcileItem;
+use App\Models\ReconcileJob;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/** GET /api/v1/admin/reconcile-jobs/{reconcile_job}/items */
+final class ReconcileItemIndexController extends Controller
+{
+    public function __invoke(Request $request, ReconcileJob $reconcile_job): JsonResponse
+    {
+        $perPage = min(max((int) $request->integer('per_page', 50), 1), 200);
+        $page = max((int) $request->integer('page', 1), 1);
+
+        $paginator = $reconcile_job->items()
+            ->orderBy('id')
+            ->paginate($perPage, ['*'], 'page', $page);
+
+        return ApiResponse::success([
+            'job_id' => (int) $reconcile_job->id,
+            'job_no' => $reconcile_job->job_no,
+            'items' => collect($paginator->items())->map(fn (ReconcileItem $r) => [
+                'id' => (int) $r->id,
+                'side_a_ref' => $r->side_a_ref,
+                'side_b_ref' => $r->side_b_ref,
+                'difference_amount' => (int) $r->difference_amount,
+                'status' => $r->status,
+                'resolved_at' => $r->resolved_at?->toIso8601String(),
+                'created_at' => $r->created_at?->toIso8601String(),
+            ])->all(),
+            'meta' => [
+                'current_page' => $paginator->currentPage(),
+                'per_page' => $paginator->perPage(),
+                'total' => $paginator->total(),
+                'last_page' => $paginator->lastPage(),
+            ],
+        ]);
+    }
+}

app/Http/Controllers/Api/V1/Admin/Reconcile/ReconcileJobIndexController.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Reconcile;
+
+use App\Http\Controllers\Controller;
+use App\Models\ReconcileJob;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/** GET /api/v1/admin/reconcile-jobs */
+final class ReconcileJobIndexController extends Controller
+{
+    public function __invoke(Request $request): JsonResponse
+    {
+        $perPage = min(max((int) $request->integer('per_page', 25), 1), 100);
+        $page = max((int) $request->integer('page', 1), 1);
+        $type = trim((string) $request->query('reconcile_type', ''));
+
+        $q = ReconcileJob::query()->orderByDesc('id');
+        if ($type !== '') {
+            $q->where('reconcile_type', $type);
+        }
+
+        $paginator = $q->paginate($perPage, ['*'], 'page', $page);
+
+        return ApiResponse::success([
+            'items' => collect($paginator->items())->map(fn (ReconcileJob $j) => $this->row($j))->all(),
+            'meta' => [
+                'current_page' => $paginator->currentPage(),
+                'per_page' => $paginator->perPage(),
+                'total' => $paginator->total(),
+                'last_page' => $paginator->lastPage(),
+            ],
+        ]);
+    }
+
+    /** @return array<string, mixed> */
+    private function row(ReconcileJob $j): array
+    {
+        return [
+            'id' => (int) $j->id,
+            'job_no' => $j->job_no,
+            'admin_user_id' => $j->admin_user_id !== null ? (int) $j->admin_user_id : null,
+            'reconcile_type' => $j->reconcile_type,
+            'status' => $j->status,
+            'period_start' => $j->period_start?->toIso8601String(),
+            'period_end' => $j->period_end?->toIso8601String(),
+            'summary_json' => $j->summary_json,
+            'finished_at' => $j->finished_at?->toIso8601String(),
+            'created_at' => $j->created_at?->toIso8601String(),
+        ];
+    }
+}

app/Http/Controllers/Api/V1/Admin/Reconcile/ReconcileJobShowController.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Reconcile;
+
+use App\Http\Controllers\Controller;
+use App\Models\ReconcileJob;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+
+/** GET /api/v1/admin/reconcile-jobs/{reconcile_job} */
+final class ReconcileJobShowController extends Controller
+{
+    public function __invoke(ReconcileJob $reconcile_job): JsonResponse
+    {
+        return ApiResponse::success([
+            'id' => (int) $reconcile_job->id,
+            'job_no' => $reconcile_job->job_no,
+            'admin_user_id' => $reconcile_job->admin_user_id !== null ? (int) $reconcile_job->admin_user_id : null,
+            'reconcile_type' => $reconcile_job->reconcile_type,
+            'status' => $reconcile_job->status,
+            'period_start' => $reconcile_job->period_start?->toIso8601String(),
+            'period_end' => $reconcile_job->period_end?->toIso8601String(),
+            'summary_json' => $reconcile_job->summary_json,
+            'finished_at' => $reconcile_job->finished_at?->toIso8601String(),
+            'created_at' => $reconcile_job->created_at?->toIso8601String(),
+        ]);
+    }
+}

app/Http/Controllers/Api/V1/Admin/Reconcile/ReconcileJobStoreController.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Reconcile;
+
+use App\Http\Controllers\Controller;
+use App\Models\AdminUser;
+use App\Services\Admin\AdminReconcileJobService;
+use App\Support\ApiResponse;
+use Carbon\Carbon;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/** POST /api/v1/admin/reconcile-jobs */
+final class ReconcileJobStoreController extends Controller
+{
+    public function __invoke(Request $request, AdminReconcileJobService $service): JsonResponse
+    {
+        /** @var AdminUser $admin */
+        $admin = $request->lotteryAdmin();
+
+        $data = validator($request->all(), [
+            'reconcile_type' => ['required', 'string', 'max:32'],
+            'period_start' => ['nullable', 'date'],
+            'period_end' => ['nullable', 'date', 'after_or_equal:period_start'],
+            'items' => ['nullable', 'array', 'max:5000'],
+            'items.*.side_a_ref' => ['nullable', 'string', 'max:128'],
+            'items.*.side_b_ref' => ['nullable', 'string', 'max:128'],
+            'items.*.difference_amount' => ['nullable', 'integer'],
+            'items.*.status' => ['nullable', 'string', 'max:32'],
+        ])->validate();
+
+        $job = $service->createJob(
+            $admin,
+            $request,
+            (string) $data['reconcile_type'],
+            isset($data['period_start']) ? Carbon::parse((string) $data['period_start']) : null,
+            isset($data['period_end']) ? Carbon::parse((string) $data['period_end']) : null,
+            isset($data['items']) ? (array) $data['items'] : null,
+        );
+
+        return ApiResponse::success([
+            'id' => (int) $job->id,
+            'job_no' => $job->job_no,
+            'status' => $job->status,
+            'summary_json' => $job->summary_json,
+            'item_count' => $job->items()->count(),
+        ]);
+    }
+}

app/Http/Controllers/Api/V1/Admin/Reports/ReportJobIndexController.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Reports;
+
+use App\Http\Controllers\Controller;
+use App\Models\ReportJob;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/** GET /api/v1/admin/report-jobs */
+final class ReportJobIndexController extends Controller
+{
+    public function __invoke(Request $request): JsonResponse
+    {
+        $perPage = min(max((int) $request->integer('per_page', 25), 1), 100);
+        $page = max((int) $request->integer('page', 1), 1);
+
+        $paginator = ReportJob::query()
+            ->orderByDesc('id')
+            ->paginate($perPage, ['*'], 'page', $page);
+
+        return ApiResponse::success([
+            'items' => collect($paginator->items())->map(fn (ReportJob $j) => $this->row($j))->all(),
+            'meta' => [
+                'current_page' => $paginator->currentPage(),
+                'per_page' => $paginator->perPage(),
+                'total' => $paginator->total(),
+                'last_page' => $paginator->lastPage(),
+            ],
+        ]);
+    }
+
+    /** @return array<string, mixed> */
+    private function row(ReportJob $j): array
+    {
+        return [
+            'id' => (int) $j->id,
+            'job_no' => $j->job_no,
+            'admin_user_id' => $j->admin_user_id !== null ? (int) $j->admin_user_id : null,
+            'report_type' => $j->report_type,
+            'export_format' => $j->export_format,
+            'filter_json' => $j->filter_json,
+            'status' => $j->status,
+            'output_path' => $j->output_path,
+            'error_message' => $j->error_message,
+            'finished_at' => $j->finished_at?->toIso8601String(),
+            'created_at' => $j->created_at?->toIso8601String(),
+        ];
+    }
+}

app/Http/Controllers/Api/V1/Admin/Reports/ReportJobShowController.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Reports;
+
+use App\Http\Controllers\Controller;
+use App\Models\ReportJob;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+
+/** GET /api/v1/admin/report-jobs/{report_job} */
+final class ReportJobShowController extends Controller
+{
+    public function __invoke(ReportJob $report_job): JsonResponse
+    {
+        return ApiResponse::success([
+            'id' => (int) $report_job->id,
+            'job_no' => $report_job->job_no,
+            'admin_user_id' => $report_job->admin_user_id !== null ? (int) $report_job->admin_user_id : null,
+            'report_type' => $report_job->report_type,
+            'export_format' => $report_job->export_format,
+            'filter_json' => $report_job->filter_json,
+            'status' => $report_job->status,
+            'output_path' => $report_job->output_path,
+            'error_message' => $report_job->error_message,
+            'finished_at' => $report_job->finished_at?->toIso8601String(),
+            'created_at' => $report_job->created_at?->toIso8601String(),
+        ]);
+    }
+}

app/Http/Controllers/Api/V1/Admin/Reports/ReportJobStoreController.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Reports;
+
+use App\Http\Controllers\Controller;
+use App\Models\AdminUser;
+use App\Services\Admin\AdminReportJobService;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/** POST /api/v1/admin/report-jobs */
+final class ReportJobStoreController extends Controller
+{
+    public function __invoke(Request $request, AdminReportJobService $service): JsonResponse
+    {
+        /** @var AdminUser $admin */
+        $admin = $request->lotteryAdmin();
+
+        $data = validator($request->all(), [
+            'report_type' => ['required', 'string', 'max:64'],
+            'export_format' => ['sometimes', 'string', 'in:csv,xlsx'],
+            'filter_json' => ['nullable', 'array'],
+        ])->validate();
+
+        $job = $service->enqueue(
+            $admin,
+            $request,
+            (string) $data['report_type'],
+            (string) ($data['export_format'] ?? 'csv'),
+            isset($data['filter_json']) ? (array) $data['filter_json'] : null,
+        );
+
+        return ApiResponse::success([
+            'id' => (int) $job->id,
+            'job_no' => $job->job_no,
+            'status' => $job->status,
+            'output_path' => $job->output_path,
+        ]);
+    }
+}

app/Http/Middleware/EnsureAdminPermission.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Lottery\ErrorCode;
+use App\Models\AdminUser;
+use App\Support\ApiResponse;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * 后台 RBAC：在 {@see EnsureAdminApi} 之后校验 `admin_permissions.slug`。
+ * 路由参数支持 `slug` 或 `slug1|slug2`（满足其一即可）。
+ */
+class EnsureAdminPermission
+{
+    public function handle(Request $request, Closure $next, string $permissionSlugs): Response
+    {
+        $admin = $request->lotteryAdmin();
+        if (! $admin instanceof AdminUser) {
+            return ApiResponse::error(
+                trans('admin.unauthenticated', [], $request->lotteryLocale()),
+                ErrorCode::AdminUnauthenticated->value,
+                null,
+                401,
+            );
+        }
+
+        $slugs = array_values(array_filter(array_map('trim', explode('|', $permissionSlugs))));
+        if ($slugs === []) {
+            return $next($request);
+        }
+
+        foreach ($slugs as $slug) {
+            if ($admin->hasAdminPermission($slug)) {
+                return $next($request);
+            }
+        }
+
+        return ApiResponse::error(
+            trans('admin.permission_denied', [], $request->lotteryLocale()),
+            ErrorCode::AdminForbidden->value,
+            ['required_any' => $slugs],
+            403,
+        );
+    }
+}

app/Lottery/ErrorCode.php

@@ -120,6 +120,9 @@ enum ErrorCode: int
     /** 登录：账号已禁用 */
     case AdminAccountDisabled = 8113;
 
+    /** 已登录但无 RBAC 权限 */
+    case AdminForbidden = 8114;
+
     /* ========== 9000–9999 系统 / 框架 ========== */
 
     /** 表单或 Query 校验失败（ValidationException → 422） */

app/Models/AdminPermission.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+
+class AdminPermission extends Model
+{
+    protected $table = 'admin_permissions';
+
+    protected $fillable = [
+        'slug',
+        'name',
+    ];
+
+    /** @return BelongsToMany<AdminRole, AdminPermission> */
+    public function roles(): BelongsToMany
+    {
+        return $this->belongsToMany(
+            AdminRole::class,
+            'admin_role_permissions',
+            'permission_id',
+            'role_id',
+        );
+    }
+}

app/Models/AdminRole.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+
+class AdminRole extends Model
+{
+    protected $table = 'admin_roles';
+
+    protected $fillable = [
+        'slug',
+        'name',
+    ];
+
+    /** @return BelongsToMany<AdminPermission, AdminRole> */
+    public function permissions(): BelongsToMany
+    {
+        return $this->belongsToMany(
+            AdminPermission::class,
+            'admin_role_permissions',
+            'role_id',
+            'permission_id',
+        );
+    }
+
+    /** @return BelongsToMany<AdminUser, AdminRole> */
+    public function users(): BelongsToMany
+    {
+        return $this->belongsToMany(
+            AdminUser::class,
+            'admin_user_roles',
+            'role_id',
+            'admin_user_id',
+        );
+    }
+}

app/Models/AdminUser.php

@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 use Laravel\Sanctum\HasApiTokens;
@@ -11,6 +12,8 @@ class AdminUser extends Authenticatable
     use HasApiTokens;
     use Notifiable;
 
+    public const ROLE_SUPER_ADMIN = 'super_admin';
+
     protected $table = 'admin_users';
 
     protected $fillable = [
@@ -34,4 +37,54 @@ class AdminUser extends Authenticatable
             'password' => 'hashed',
         ];
     }
+
+    /** @return BelongsToMany<AdminRole, AdminUser> */
+    public function roles(): BelongsToMany
+    {
+        return $this->belongsToMany(
+            AdminRole::class,
+            'admin_user_roles',
+            'admin_user_id',
+            'role_id',
+        );
+    }
+
+    /** 是否具备指定权限（含 `super_admin` 角色全放行）。 */
+    public function hasAdminPermission(string $slug): bool
+    {
+        $this->loadMissing(['roles.permissions']);
+
+        foreach ($this->roles as $role) {
+            if ($role->slug === self::ROLE_SUPER_ADMIN) {
+                return true;
+            }
+            foreach ($role->permissions as $permission) {
+                if ($permission->slug === $slug) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * @return list<string>
+     */
+    public function adminPermissionSlugs(): array
+    {
+        $this->loadMissing(['roles.permissions']);
+        if ($this->roles->contains('slug', self::ROLE_SUPER_ADMIN)) {
+            return AdminPermission::query()->orderBy('slug')->pluck('slug')->all();
+        }
+
+        $out = [];
+        foreach ($this->roles as $role) {
+            foreach ($role->permissions as $permission) {
+                $out[$permission->slug] = true;
+            }
+        }
+
+        return array_keys($out);
+    }
 }

app/Models/ReconcileItem.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class ReconcileItem extends Model
+{
+    protected $table = 'reconcile_items';
+
+    protected $fillable = [
+        'reconcile_job_id',
+        'side_a_ref',
+        'side_b_ref',
+        'difference_amount',
+        'status',
+        'resolved_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'difference_amount' => 'integer',
+            'resolved_at' => 'datetime',
+        ];
+    }
+
+    /** @return BelongsTo<ReconcileJob, ReconcileItem> */
+    public function reconcileJob(): BelongsTo
+    {
+        return $this->belongsTo(ReconcileJob::class, 'reconcile_job_id');
+    }
+}

app/Models/ReconcileJob.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+class ReconcileJob extends Model
+{
+    protected $table = 'reconcile_jobs';
+
+    protected $fillable = [
+        'job_no',
+        'admin_user_id',
+        'reconcile_type',
+        'status',
+        'period_start',
+        'period_end',
+        'summary_json',
+        'finished_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'period_start' => 'datetime',
+            'period_end' => 'datetime',
+            'summary_json' => 'array',
+            'finished_at' => 'datetime',
+        ];
+    }
+
+    /** @return BelongsTo<AdminUser, ReconcileJob> */
+    public function adminUser(): BelongsTo
+    {
+        return $this->belongsTo(AdminUser::class, 'admin_user_id');
+    }
+
+    /** @return HasMany<ReconcileItem, ReconcileJob> */
+    public function items(): HasMany
+    {
+        return $this->hasMany(ReconcileItem::class, 'reconcile_job_id');
+    }
+}

app/Models/ReportJob.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class ReportJob extends Model
+{
+    protected $table = 'report_jobs';
+
+    protected $fillable = [
+        'job_no',
+        'admin_user_id',
+        'report_type',
+        'export_format',
+        'filter_json',
+        'status',
+        'output_path',
+        'error_message',
+        'finished_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'filter_json' => 'array',
+            'finished_at' => 'datetime',
+        ];
+    }
+
+    /** @return BelongsTo<AdminUser, ReportJob> */
+    public function adminUser(): BelongsTo
+    {
+        return $this->belongsTo(AdminUser::class, 'admin_user_id');
+    }
+}

app/Services/Admin/AdminReconcileJobService.php

@@ -0,0 +1,84 @@
+<?php
+
+namespace App\Services\Admin;
+
+use App\Models\AdminUser;
+use App\Models\ReconcileItem;
+use App\Models\ReconcileJob;
+use App\Services\AuditLogger;
+use Carbon\Carbon;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+
+/**
+ * 对账任务：落库 `reconcile_jobs` / `reconcile_items`（阶段 7；差异引擎可后续替换）。
+ */
+final class AdminReconcileJobService
+{
+    /**
+     * @param  list<array{side_a_ref?: ?string, side_b_ref?: ?string, difference_amount?: int, status?: string}>|null  $items
+     */
+    public function createJob(
+        AdminUser $admin,
+        Request $request,
+        string $reconcileType,
+        ?Carbon $periodStart,
+        ?Carbon $periodEnd,
+        ?array $items,
+    ): ReconcileJob {
+        return DB::transaction(function () use ($admin, $request, $reconcileType, $periodStart, $periodEnd, $items): ReconcileJob {
+            $jobNo = 'REC'.now()->format('YmdHis').strtoupper(Str::random(4));
+
+            $job = ReconcileJob::query()->create([
+                'job_no' => $jobNo,
+                'admin_user_id' => (int) $admin->getKey(),
+                'reconcile_type' => $reconcileType,
+                'status' => 'completed',
+                'period_start' => $periodStart,
+                'period_end' => $periodEnd,
+                'summary_json' => null,
+                'finished_at' => now(),
+            ]);
+
+            $mismatch = 0;
+            foreach ($items ?? [] as $row) {
+                ReconcileItem::query()->create([
+                    'reconcile_job_id' => (int) $job->getKey(),
+                    'side_a_ref' => $row['side_a_ref'] ?? null,
+                    'side_b_ref' => $row['side_b_ref'] ?? null,
+                    'difference_amount' => (int) ($row['difference_amount'] ?? 0),
+                    'status' => (string) ($row['status'] ?? 'mismatch'),
+                    'resolved_at' => null,
+                ]);
+                if (($row['status'] ?? 'mismatch') === 'mismatch') {
+                    $mismatch++;
+                }
+            }
+
+            $job->forceFill([
+                'summary_json' => [
+                    'item_count' => count($items ?? []),
+                    'mismatch_count' => $mismatch,
+                ],
+            ])->save();
+
+            AuditLogger::recordForAdmin(
+                $admin,
+                $request,
+                'reconcile_jobs',
+                'create',
+                'reconcile_job',
+                (string) $job->getKey(),
+                null,
+                [
+                    'job_no' => $jobNo,
+                    'reconcile_type' => $reconcileType,
+                    'item_count' => count($items ?? []),
+                ],
+            );
+
+            return $job->fresh();
+        });
+    }
+}

app/Services/Admin/AdminReportJobService.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Services\Admin;
+
+use App\Models\AdminUser;
+use App\Models\ReportJob;
+use App\Services\AuditLogger;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+
+/**
+ * 报表导出任务：落库 `report_jobs`（阶段 7；异步生成可后续接队列）。
+ */
+final class AdminReportJobService
+{
+    /**
+     * @param  array<string, mixed>|null  $filterJson
+     */
+    public function enqueue(AdminUser $admin, Request $request, string $reportType, string $exportFormat, ?array $filterJson): ReportJob
+    {
+        return DB::transaction(function () use ($admin, $request, $reportType, $exportFormat, $filterJson): ReportJob {
+            $jobNo = 'RPT'.now()->format('YmdHis').strtoupper(Str::random(4));
+
+            $job = ReportJob::query()->create([
+                'job_no' => $jobNo,
+                'admin_user_id' => (int) $admin->getKey(),
+                'report_type' => $reportType,
+                'export_format' => $exportFormat,
+                'filter_json' => $filterJson,
+                'status' => 'completed',
+                'output_path' => 'reports/'.$jobNo.'.'.$exportFormat,
+                'error_message' => null,
+                'finished_at' => now(),
+            ]);
+
+            AuditLogger::recordForAdmin(
+                $admin,
+                $request,
+                'report_jobs',
+                'enqueue',
+                'report_job',
+                (string) $job->getKey(),
+                null,
+                [
+                    'job_no' => $jobNo,
+                    'report_type' => $reportType,
+                    'export_format' => $exportFormat,
+                ],
+            );
+
+            return $job;
+        });
+    }
+}