feat: 增强管理员权限管理，添加 RBAC 支持，更新 AdminUser 模型以处理角色和权限，更新登录接口返回权限信息，扩展数据库填充器以同步角色权限

app/Http/Controllers/Api/V1/Admin/Audit/AuditLogIndexController.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Audit;
+
+use App\Http\Controllers\Controller;
+use App\Models\AuditLog;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/**
+ * GET /api/v1/admin/audit-logs — 运营/客服查询审计留痕。
+ */
+final class AuditLogIndexController extends Controller
+{
+    public function __invoke(Request $request): JsonResponse
+    {
+        $perPage = min(max((int) $request->integer('per_page', 25), 1), 100);
+        $page = max((int) $request->integer('page', 1), 1);
+        $module = trim((string) $request->query('module_code', ''));
+        $action = trim((string) $request->query('action_code', ''));
+        $operatorType = trim((string) $request->query('operator_type', ''));
+
+        $q = AuditLog::query()->orderByDesc('id');
+
+        if ($module !== '') {
+            $q->where('module_code', $module);
+        }
+        if ($action !== '') {
+            $q->where('action_code', $action);
+        }
+        if ($operatorType !== '') {
+            $q->where('operator_type', $operatorType);
+        }
+
+        $paginator = $q->paginate($perPage, ['*'], 'page', $page);
+
+        return ApiResponse::success([
+            'items' => collect($paginator->items())->map(fn (AuditLog $r) => $this->row($r))->all(),
+            'meta' => [
+                'current_page' => $paginator->currentPage(),
+                'per_page' => $paginator->perPage(),
+                'total' => $paginator->total(),
+                'last_page' => $paginator->lastPage(),
+            ],
+        ]);
+    }
+
+    /** @return array<string, mixed> */
+    private function row(AuditLog $r): array
+    {
+        return [
+            'id' => (int) $r->id,
+            'operator_type' => $r->operator_type,
+            'operator_id' => (int) $r->operator_id,
+            'module_code' => $r->module_code,
+            'action_code' => $r->action_code,
+            'target_type' => $r->target_type,
+            'target_id' => $r->target_id,
+            'before_json' => $r->before_json,
+            'after_json' => $r->after_json,
+            'ip' => $r->ip,
+            'user_agent' => $r->user_agent,
+            'created_at' => $r->created_at?->toIso8601String(),
+        ];
+    }
+}

app/Http/Controllers/Api/V1/Admin/Auth/LoginController.php

@@ -87,6 +87,7 @@ final class LoginController
                 'username' => $admin->username,
                 'nickname' => $admin->name,
                 'email' => $admin->email,
+                'permissions' => $admin->fresh()->adminPermissionSlugs(),
             ],
         ]);
     }

app/Http/Controllers/Api/V1/Admin/Draw/AdminDrawFinanceSummaryController.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Draw;
+
+use App\Http\Controllers\Controller;
+use App\Models\Draw;
+use App\Models\SettlementBatch;
+use App\Models\TicketItem;
+use App\Models\TicketOrder;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+
+/**
+ * GET /api/v1/admin/draws/{draw}/finance-summary — 单期投注/派彩汇总（客服/财务视角，PRD §15.4）。
+ *
+ * 口径：以订单实扣汇总为「当期投注」；以注项中奖+Jackpot 为「当期派彩」；差额为近似毛损益（不含回水等细项）。
+ */
+final class AdminDrawFinanceSummaryController extends Controller
+{
+    public function __invoke(Draw $draw): JsonResponse
+    {
+        $drawId = (int) $draw->id;
+
+        $totalBetMinor = (int) TicketOrder::query()->where('draw_id', $drawId)->sum('total_actual_deduct');
+        $orderCount = (int) TicketOrder::query()->where('draw_id', $drawId)->count();
+        $itemCount = (int) TicketItem::query()->where('draw_id', $drawId)->count();
+
+        $currencyCode = (string) (TicketOrder::query()
+            ->where('draw_id', $drawId)
+            ->value('currency_code') ?? '');
+
+        $totalWinMinor = (int) TicketItem::query()->where('draw_id', $drawId)->sum('win_amount');
+        $totalJackpotWinMinor = (int) TicketItem::query()->where('draw_id', $drawId)->sum('jackpot_win_amount');
+        $totalPayoutMinor = $totalWinMinor + $totalJackpotWinMinor;
+        $approxHouseGrossMinor = $totalBetMinor - $totalPayoutMinor;
+
+        $batches = SettlementBatch::query()
+            ->where('draw_id', $drawId)
+            ->orderByDesc('id')
+            ->limit(30)
+            ->get(['id', 'status', 'total_ticket_count', 'total_win_count', 'total_payout_amount', 'total_jackpot_payout_amount', 'finished_at']);
+
+        $batchRows = $batches->map(static function (SettlementBatch $b): array {
+            return [
+                'id' => (int) $b->id,
+                'status' => $b->status,
+                'total_ticket_count' => (int) $b->total_ticket_count,
+                'total_win_count' => (int) $b->total_win_count,
+                'total_payout_amount' => (int) $b->total_payout_amount,
+                'total_jackpot_payout_amount' => (int) $b->total_jackpot_payout_amount,
+                'finished_at' => $b->finished_at?->toIso8601String(),
+            ];
+        })->values()->all();
+
+        return ApiResponse::success([
+            'draw_id' => $drawId,
+            'draw_no' => $draw->draw_no,
+            'draw_status' => $draw->status,
+            'currency_code' => $currencyCode !== '' ? $currencyCode : null,
+            'order_count' => $orderCount,
+            'ticket_item_count' => $itemCount,
+            'total_bet_minor' => $totalBetMinor,
+            'total_win_payout_minor' => $totalWinMinor,
+            'total_jackpot_win_minor' => $totalJackpotWinMinor,
+            'total_payout_minor' => $totalPayoutMinor,
+            'approx_house_gross_minor' => $approxHouseGrossMinor,
+            'settlement_batches' => $batchRows,
+        ]);
+    }
+}

app/Http/Controllers/Api/V1/Admin/Player/AdminPlayerTicketItemsIndexController.php

@@ -0,0 +1,74 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Player;
+
+use App\Http\Controllers\Controller;
+use App\Models\Player;
+use App\Models\TicketItem;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/**
+ * GET /api/v1/admin/players/{player}/ticket-items — 客服/财务按玩家查注单（PRD §15.4）。
+ *
+ * Query：`page`、`per_page`（最大 50）、`draw_no`（可选，精确期号）。
+ */
+final class AdminPlayerTicketItemsIndexController extends Controller
+{
+    public function __invoke(Request $request, Player $player): JsonResponse
+    {
+        $validated = validator($request->query(), [
+            'page' => ['sometimes', 'integer', 'min:1'],
+            'per_page' => ['sometimes', 'integer', 'min:1', 'max:50'],
+            'draw_no' => ['sometimes', 'nullable', 'string', 'max:32'],
+        ])->validate();
+
+        $perPage = max(1, min(50, (int) ($validated['per_page'] ?? 20)));
+        $page = max(1, (int) ($validated['page'] ?? 1));
+        $drawNo = isset($validated['draw_no']) ? trim((string) $validated['draw_no']) : '';
+
+        $query = TicketItem::query()
+            ->where('ticket_items.player_id', $player->id)
+            ->with([
+                'draw:id,draw_no,business_date',
+                'order:id,order_no,currency_code,created_at',
+            ])
+            ->orderByDesc('ticket_items.id');
+
+        if ($drawNo !== '') {
+            $query->whereHas('draw', fn ($q) => $q->where('draw_no', $drawNo));
+        }
+
+        $paginator = $query->paginate(perPage: $perPage, page: $page, columns: ['*']);
+
+        $items = collect($paginator->items())->map(function (TicketItem $row): array {
+            return [
+                'ticket_no' => $row->ticket_no,
+                'order_no' => $row->order?->order_no,
+                'draw_no' => $row->draw?->draw_no,
+                'currency_code' => $row->order?->currency_code,
+                'play_code' => $row->play_code,
+                'original_number' => $row->original_number,
+                'total_bet_amount' => (int) $row->total_bet_amount,
+                'actual_deduct_amount' => (int) $row->actual_deduct_amount,
+                'status' => $row->status,
+                'fail_reason_code' => $row->fail_reason_code,
+                'fail_reason_text' => $row->fail_reason_text,
+                'win_amount' => (int) $row->win_amount,
+                'jackpot_win_amount' => (int) $row->jackpot_win_amount,
+                'placed_at' => $row->order?->created_at?->toIso8601String(),
+                'updated_at' => $row->updated_at?->toIso8601String(),
+            ];
+        })->values()->all();
+
+        return ApiResponse::success([
+            'player_id' => (int) $player->id,
+            'items' => $items,
+            'total' => $paginator->total(),
+            'page' => $paginator->currentPage(),
+            'per_page' => $paginator->perPage(),
+            'last_page' => $paginator->lastPage(),
+        ]);
+    }
+}

app/Http/Controllers/Api/V1/Admin/Reconcile/ReconcileItemIndexController.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Reconcile;
+
+use App\Http\Controllers\Controller;
+use App\Models\ReconcileItem;
+use App\Models\ReconcileJob;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/** GET /api/v1/admin/reconcile-jobs/{reconcile_job}/items */
+final class ReconcileItemIndexController extends Controller
+{
+    public function __invoke(Request $request, ReconcileJob $reconcile_job): JsonResponse
+    {
+        $perPage = min(max((int) $request->integer('per_page', 50), 1), 200);
+        $page = max((int) $request->integer('page', 1), 1);
+
+        $paginator = $reconcile_job->items()
+            ->orderBy('id')
+            ->paginate($perPage, ['*'], 'page', $page);
+
+        return ApiResponse::success([
+            'job_id' => (int) $reconcile_job->id,
+            'job_no' => $reconcile_job->job_no,
+            'items' => collect($paginator->items())->map(fn (ReconcileItem $r) => [
+                'id' => (int) $r->id,
+                'side_a_ref' => $r->side_a_ref,
+                'side_b_ref' => $r->side_b_ref,
+                'difference_amount' => (int) $r->difference_amount,
+                'status' => $r->status,
+                'resolved_at' => $r->resolved_at?->toIso8601String(),
+                'created_at' => $r->created_at?->toIso8601String(),
+            ])->all(),
+            'meta' => [
+                'current_page' => $paginator->currentPage(),
+                'per_page' => $paginator->perPage(),
+                'total' => $paginator->total(),
+                'last_page' => $paginator->lastPage(),
+            ],
+        ]);
+    }
+}

app/Http/Controllers/Api/V1/Admin/Reconcile/ReconcileJobIndexController.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Reconcile;
+
+use App\Http\Controllers\Controller;
+use App\Models\ReconcileJob;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/** GET /api/v1/admin/reconcile-jobs */
+final class ReconcileJobIndexController extends Controller
+{
+    public function __invoke(Request $request): JsonResponse
+    {
+        $perPage = min(max((int) $request->integer('per_page', 25), 1), 100);
+        $page = max((int) $request->integer('page', 1), 1);
+        $type = trim((string) $request->query('reconcile_type', ''));
+
+        $q = ReconcileJob::query()->orderByDesc('id');
+        if ($type !== '') {
+            $q->where('reconcile_type', $type);
+        }
+
+        $paginator = $q->paginate($perPage, ['*'], 'page', $page);
+
+        return ApiResponse::success([
+            'items' => collect($paginator->items())->map(fn (ReconcileJob $j) => $this->row($j))->all(),
+            'meta' => [
+                'current_page' => $paginator->currentPage(),
+                'per_page' => $paginator->perPage(),
+                'total' => $paginator->total(),
+                'last_page' => $paginator->lastPage(),
+            ],
+        ]);
+    }
+
+    /** @return array<string, mixed> */
+    private function row(ReconcileJob $j): array
+    {
+        return [
+            'id' => (int) $j->id,
+            'job_no' => $j->job_no,
+            'admin_user_id' => $j->admin_user_id !== null ? (int) $j->admin_user_id : null,
+            'reconcile_type' => $j->reconcile_type,
+            'status' => $j->status,
+            'period_start' => $j->period_start?->toIso8601String(),
+            'period_end' => $j->period_end?->toIso8601String(),
+            'summary_json' => $j->summary_json,
+            'finished_at' => $j->finished_at?->toIso8601String(),
+            'created_at' => $j->created_at?->toIso8601String(),
+        ];
+    }
+}

app/Http/Controllers/Api/V1/Admin/Reconcile/ReconcileJobShowController.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Reconcile;
+
+use App\Http\Controllers\Controller;
+use App\Models\ReconcileJob;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+
+/** GET /api/v1/admin/reconcile-jobs/{reconcile_job} */
+final class ReconcileJobShowController extends Controller
+{
+    public function __invoke(ReconcileJob $reconcile_job): JsonResponse
+    {
+        return ApiResponse::success([
+            'id' => (int) $reconcile_job->id,
+            'job_no' => $reconcile_job->job_no,
+            'admin_user_id' => $reconcile_job->admin_user_id !== null ? (int) $reconcile_job->admin_user_id : null,
+            'reconcile_type' => $reconcile_job->reconcile_type,
+            'status' => $reconcile_job->status,
+            'period_start' => $reconcile_job->period_start?->toIso8601String(),
+            'period_end' => $reconcile_job->period_end?->toIso8601String(),
+            'summary_json' => $reconcile_job->summary_json,
+            'finished_at' => $reconcile_job->finished_at?->toIso8601String(),
+            'created_at' => $reconcile_job->created_at?->toIso8601String(),
+        ]);
+    }
+}

app/Http/Controllers/Api/V1/Admin/Reconcile/ReconcileJobStoreController.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Reconcile;
+
+use App\Http\Controllers\Controller;
+use App\Models\AdminUser;
+use App\Services\Admin\AdminReconcileJobService;
+use App\Support\ApiResponse;
+use Carbon\Carbon;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/** POST /api/v1/admin/reconcile-jobs */
+final class ReconcileJobStoreController extends Controller
+{
+    public function __invoke(Request $request, AdminReconcileJobService $service): JsonResponse
+    {
+        /** @var AdminUser $admin */
+        $admin = $request->lotteryAdmin();
+
+        $data = validator($request->all(), [
+            'reconcile_type' => ['required', 'string', 'max:32'],
+            'period_start' => ['nullable', 'date'],
+            'period_end' => ['nullable', 'date', 'after_or_equal:period_start'],
+            'items' => ['nullable', 'array', 'max:5000'],
+            'items.*.side_a_ref' => ['nullable', 'string', 'max:128'],
+            'items.*.side_b_ref' => ['nullable', 'string', 'max:128'],
+            'items.*.difference_amount' => ['nullable', 'integer'],
+            'items.*.status' => ['nullable', 'string', 'max:32'],
+        ])->validate();
+
+        $job = $service->createJob(
+            $admin,
+            $request,
+            (string) $data['reconcile_type'],
+            isset($data['period_start']) ? Carbon::parse((string) $data['period_start']) : null,
+            isset($data['period_end']) ? Carbon::parse((string) $data['period_end']) : null,
+            isset($data['items']) ? (array) $data['items'] : null,
+        );
+
+        return ApiResponse::success([
+            'id' => (int) $job->id,
+            'job_no' => $job->job_no,
+            'status' => $job->status,
+            'summary_json' => $job->summary_json,
+            'item_count' => $job->items()->count(),
+        ]);
+    }
+}

app/Http/Controllers/Api/V1/Admin/Reports/ReportJobIndexController.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Reports;
+
+use App\Http\Controllers\Controller;
+use App\Models\ReportJob;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/** GET /api/v1/admin/report-jobs */
+final class ReportJobIndexController extends Controller
+{
+    public function __invoke(Request $request): JsonResponse
+    {
+        $perPage = min(max((int) $request->integer('per_page', 25), 1), 100);
+        $page = max((int) $request->integer('page', 1), 1);
+
+        $paginator = ReportJob::query()
+            ->orderByDesc('id')
+            ->paginate($perPage, ['*'], 'page', $page);
+
+        return ApiResponse::success([
+            'items' => collect($paginator->items())->map(fn (ReportJob $j) => $this->row($j))->all(),
+            'meta' => [
+                'current_page' => $paginator->currentPage(),
+                'per_page' => $paginator->perPage(),
+                'total' => $paginator->total(),
+                'last_page' => $paginator->lastPage(),
+            ],
+        ]);
+    }
+
+    /** @return array<string, mixed> */
+    private function row(ReportJob $j): array
+    {
+        return [
+            'id' => (int) $j->id,
+            'job_no' => $j->job_no,
+            'admin_user_id' => $j->admin_user_id !== null ? (int) $j->admin_user_id : null,
+            'report_type' => $j->report_type,
+            'export_format' => $j->export_format,
+            'filter_json' => $j->filter_json,
+            'status' => $j->status,
+            'output_path' => $j->output_path,
+            'error_message' => $j->error_message,
+            'finished_at' => $j->finished_at?->toIso8601String(),
+            'created_at' => $j->created_at?->toIso8601String(),
+        ];
+    }
+}

app/Http/Controllers/Api/V1/Admin/Reports/ReportJobShowController.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Reports;
+
+use App\Http\Controllers\Controller;
+use App\Models\ReportJob;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+
+/** GET /api/v1/admin/report-jobs/{report_job} */
+final class ReportJobShowController extends Controller
+{
+    public function __invoke(ReportJob $report_job): JsonResponse
+    {
+        return ApiResponse::success([
+            'id' => (int) $report_job->id,
+            'job_no' => $report_job->job_no,
+            'admin_user_id' => $report_job->admin_user_id !== null ? (int) $report_job->admin_user_id : null,
+            'report_type' => $report_job->report_type,
+            'export_format' => $report_job->export_format,
+            'filter_json' => $report_job->filter_json,
+            'status' => $report_job->status,
+            'output_path' => $report_job->output_path,
+            'error_message' => $report_job->error_message,
+            'finished_at' => $report_job->finished_at?->toIso8601String(),
+            'created_at' => $report_job->created_at?->toIso8601String(),
+        ]);
+    }
+}

app/Http/Controllers/Api/V1/Admin/Reports/ReportJobStoreController.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Admin\Reports;
+
+use App\Http\Controllers\Controller;
+use App\Models\AdminUser;
+use App\Services\Admin\AdminReportJobService;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/** POST /api/v1/admin/report-jobs */
+final class ReportJobStoreController extends Controller
+{
+    public function __invoke(Request $request, AdminReportJobService $service): JsonResponse
+    {
+        /** @var AdminUser $admin */
+        $admin = $request->lotteryAdmin();
+
+        $data = validator($request->all(), [
+            'report_type' => ['required', 'string', 'max:64'],
+            'export_format' => ['sometimes', 'string', 'in:csv,xlsx'],
+            'filter_json' => ['nullable', 'array'],
+        ])->validate();
+
+        $job = $service->enqueue(
+            $admin,
+            $request,
+            (string) $data['report_type'],
+            (string) ($data['export_format'] ?? 'csv'),
+            isset($data['filter_json']) ? (array) $data['filter_json'] : null,
+        );
+
+        return ApiResponse::success([
+            'id' => (int) $job->id,
+            'job_no' => $job->job_no,
+            'status' => $job->status,
+            'output_path' => $job->output_path,
+        ]);
+    }
+}

app/Http/Middleware/EnsureAdminPermission.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Lottery\ErrorCode;
+use App\Models\AdminUser;
+use App\Support\ApiResponse;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * 后台 RBAC：在 {@see EnsureAdminApi} 之后校验 `admin_permissions.slug`。
+ * 路由参数支持 `slug` 或 `slug1|slug2`（满足其一即可）。
+ */
+class EnsureAdminPermission
+{
+    public function handle(Request $request, Closure $next, string $permissionSlugs): Response
+    {
+        $admin = $request->lotteryAdmin();
+        if (! $admin instanceof AdminUser) {
+            return ApiResponse::error(
+                trans('admin.unauthenticated', [], $request->lotteryLocale()),
+                ErrorCode::AdminUnauthenticated->value,
+                null,
+                401,
+            );
+        }
+
+        $slugs = array_values(array_filter(array_map('trim', explode('|', $permissionSlugs))));
+        if ($slugs === []) {
+            return $next($request);
+        }
+
+        foreach ($slugs as $slug) {
+            if ($admin->hasAdminPermission($slug)) {
+                return $next($request);
+            }
+        }
+
+        return ApiResponse::error(
+            trans('admin.permission_denied', [], $request->lotteryLocale()),
+            ErrorCode::AdminForbidden->value,
+            ['required_any' => $slugs],
+            403,
+        );
+    }
+}