feat: 增强钱包 API URL 验证与配置

- 在 AdminIntegrationSiteStoreRequest 和 AdminIntegrationSiteUpdateRequest 中引入 WalletApiUrlRule，确保 wallet_api_url 字段符合 HTTPS 公开域名要求。
- 更新 HttpMainSiteWalletBalanceClient 和 HttpMainSiteWalletGateway，使用 WalletApiUrlSanitizer 进行 URL 规范化与验证，防止 SSRF 攻击。
- 新增测试用例，验证 wallet_api_url 的有效性，确保系统安全性与稳定性。
- 更新 .env.example 文件，添加 LOTTERY_RISK_POOL_USE_REDIS_LUA 配置项以支持 Redis Lua 原子扣减功能。
- 修改 package-lock.json 中的项目名称，确保一致性。
- 在 API 路由中新增 integration/runtime-origins 路由，提供运行时白名单功能。

app/Http/Controllers/Api/V1/Integration/IntegrationRuntimeOriginsController.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1\Integration;
+
+use App\Http\Controllers\Controller;
+use App\Models\AdminSite;
+use App\Support\ApiResponse;
+use Illuminate\Http\JsonResponse;
+
+/**
+ * 玩家端 iframe 运行时白名单。
+ *
+ * 只公开启用站点的 origin，不包含任何密钥或钱包地址。
+ */
+final class IntegrationRuntimeOriginsController extends Controller
+{
+    public function __invoke(): JsonResponse
+    {
+        $origins = AdminSite::query()
+            ->where('status', 1)
+            ->pluck('iframe_allowed_origins')
+            ->flatMap(static function (mixed $value): array {
+                if (is_string($value)) {
+                    $decoded = json_decode($value, true);
+                    $value = is_array($decoded) ? $decoded : [];
+                }
+
+                if (! is_array($value)) {
+                    return [];
+                }
+
+                return array_values(array_filter(
+                    array_map(
+                        static fn (mixed $origin): string => is_string($origin) ? trim($origin) : '',
+                        $value,
+                    ),
+                    static fn (string $origin): bool => $origin !== '',
+                ));
+            })
+            ->unique()
+            ->values()
+            ->all();
+
+        return ApiResponse::success([
+            'iframe_allowed_origins' => $origins,
+        ]);
+    }
+}

app/Http/Requests/Admin/AdminIntegrationSiteStoreRequest.php

@@ -4,6 +4,7 @@ namespace App\Http\Requests\Admin;
 
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
+use App\Rules\WalletApiUrlRule;
 
 final class AdminIntegrationSiteStoreRequest extends FormRequest
 {
@@ -20,7 +21,7 @@ final class AdminIntegrationSiteStoreRequest extends FormRequest
             'name' => ['required', 'string', 'max:128'],
             'currency_code' => ['sometimes', 'string', 'max:16'],
             'status' => ['sometimes', 'integer', 'in:0,1'],
-            'wallet_api_url' => ['nullable', 'string', 'max:512'],
+            'wallet_api_url' => ['nullable', 'string', 'max:512', new WalletApiUrlRule()],
             'wallet_debit_path' => ['sometimes', 'string', 'max:128'],
             'wallet_credit_path' => ['sometimes', 'string', 'max:128'],
             'wallet_balance_path' => ['sometimes', 'string', 'max:128'],

app/Http/Requests/Admin/AdminIntegrationSiteUpdateRequest.php

@@ -3,6 +3,7 @@
 namespace App\Http\Requests\Admin;
 
 use Illuminate\Foundation\Http\FormRequest;
+use App\Rules\WalletApiUrlRule;
 
 final class AdminIntegrationSiteUpdateRequest extends FormRequest
 {
@@ -18,7 +19,7 @@ final class AdminIntegrationSiteUpdateRequest extends FormRequest
             'name' => ['required', 'string', 'max:128'],
             'currency_code' => ['sometimes', 'string', 'max:16'],
             'status' => ['sometimes', 'integer', 'in:0,1'],
-            'wallet_api_url' => ['nullable', 'string', 'max:512'],
+            'wallet_api_url' => ['nullable', 'string', 'max:512', new WalletApiUrlRule()],
             'wallet_debit_path' => ['sometimes', 'string', 'max:128'],
             'wallet_credit_path' => ['sometimes', 'string', 'max:128'],
             'wallet_balance_path' => ['sometimes', 'string', 'max:128'],