fix(withdraw): allow multiple active applications

tests/test_withdraw.py

@@ -268,6 +268,34 @@ def test_withdraw_idempotent_same_bill_no(client, monkeypatch) -> None:
     assert sum(1 for t in r.json()["items"] if t["biz_type"] == "withdraw") == 1
 
 
+def test_withdraw_allows_multiple_active_orders_with_distinct_bill_no(client, monkeypatch) -> None:
+    """不同 out_bill_no 是不同提现意图,允许同时处于 reviewing；每笔分别扣款建单。"""
+    _patch_userinfo(monkeypatch, "openid_multi_active")
+    token = _login(client, "13800002017")
+    _seed_cash(client, token, "13800002017", 200)
+    client.post("/api/v1/wallet/bind-wechat", json={"code": "c"}, headers=_auth(token))
+
+    r1 = client.post(
+        "/api/v1/wallet/withdraw",
+        json={"amount_cents": 50, "out_bill_no": "multi_active_bill_1"},
+        headers=_auth(token),
+    )
+    r2 = client.post(
+        "/api/v1/wallet/withdraw",
+        json={"amount_cents": 50, "out_bill_no": "multi_active_bill_2"},
+        headers=_auth(token),
+    )
+
+    assert r1.status_code == 200 and r1.json()["status"] == "reviewing", r1.text
+    assert r2.status_code == 200 and r2.json()["status"] == "reviewing", r2.text
+    assert r1.json()["out_bill_no"] != r2.json()["out_bill_no"]
+
+    account = client.get("/api/v1/wallet/account", headers=_auth(token)).json()
+    assert account["cash_balance_cents"] == 100
+    txns = client.get("/api/v1/wallet/cash-transactions", headers=_auth(token)).json()["items"]
+    assert sum(1 for t in txns if t["biz_type"] == "withdraw") == 2
+
+
 def test_withdraw_ambiguous_timeout_then_success_no_refund(client, monkeypatch) -> None:
     """#3 转账调用超时(异常),但查单确认已 SUCCESS → 不退款,单置 success。"""
     monkeypatch.setattr("app.integrations.wxpay.code_to_userinfo", lambda code: {"openid": "openid_amb", "nickname": None, "avatar_url": None, "raw": {}})