feat: 后端接入微信提现人工审核与资金安全校验

提现申请改为先扣款并进入待审核，审核通过后才发起微信打款，审核拒绝或微信失败时自动退款。

新增运营后台提现列表的关键词搜索、日期筛选、快捷筛选和排序参数，并支持批量通过、批量拒绝、批量刷新查单。

新增微信支付配置健康检查、现金账本校验、自动对账 worker 和单实例保护。

新增数据库唯一索引，约束同一用户未完成提现和同一提现单重复退款，提升并发安全性。

app/integrations/wxpay.py

@@ -14,7 +14,9 @@ import base64
 import json
 import time
 import uuid
+from pathlib import Path
 
+import certifi
 import httpx
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import padding
@@ -23,6 +25,7 @@ from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey, RSAPubl
 from app.core.config import settings
 
 _API_HOST = "https://api.mch.weixin.qq.com"
+_PROJECT_ROOT = Path(__file__).resolve().parents[2]
 _TRANSFER_PATH = "/v3/fund-app/mch-transfer/transfer-bills"
 # 免确认收款授权(用户授权免确认模式)
 _AUTH_PATH = "/v3/fund-app/mch-transfer/user-confirm-authorization"
@@ -38,15 +41,30 @@ class WxPayNotConfiguredError(Exception):
     """微信支付凭证 / 证书缺失,无法调用。"""
 
 
+def _http_client() -> httpx.Client:
+    """微信相关 HTTP 客户端。
+
+    显式使用当前 Python 环境的 certifi 证书,避免被外部 SSL_CERT_FILE 指到不存在文件。
+    代理仍允许从环境变量读取,方便本地开发。
+    """
+    return httpx.Client(verify=certifi.where())
+
+
+def _resolve_config_path(value: str) -> Path:
+    path = Path(value)
+    return path if path.is_absolute() else _PROJECT_ROOT / path
+
+
 def _load_private_key() -> RSAPrivateKey:
     global _private_key
     if _private_key is None:
+        key_path = _resolve_config_path(settings.WXPAY_MCH_PRIVATE_KEY_PATH)
         try:
-            with open(settings.WXPAY_MCH_PRIVATE_KEY_PATH, "rb") as f:
+            with key_path.open("rb") as f:
                 _private_key = serialization.load_pem_private_key(f.read(), password=None)
         except FileNotFoundError as e:
             raise WxPayNotConfiguredError(
-                f"商户私钥不存在: {settings.WXPAY_MCH_PRIVATE_KEY_PATH}"
+                f"商户私钥不存在: {key_path}"
             ) from e
     return _private_key
 
@@ -54,12 +72,13 @@ def _load_private_key() -> RSAPrivateKey:
 def _load_public_key() -> RSAPublicKey:
     global _public_key
     if _public_key is None:
+        key_path = _resolve_config_path(settings.WXPAY_PUBLIC_KEY_PATH)
         try:
-            with open(settings.WXPAY_PUBLIC_KEY_PATH, "rb") as f:
+            with key_path.open("rb") as f:
                 _public_key = serialization.load_pem_public_key(f.read())
         except FileNotFoundError as e:
             raise WxPayNotConfiguredError(
-                f"微信支付平台公钥不存在: {settings.WXPAY_PUBLIC_KEY_PATH}"
+                f"微信支付平台公钥不存在: {key_path}"
             ) from e
     return _public_key
 
@@ -126,7 +145,7 @@ def create_transfer(
         "Content-Type": "application/json",
         "Wechatpay-Serial": settings.WXPAY_PUBLIC_KEY_ID,
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.post(
             f"{_API_HOST}{_TRANSFER_PATH}",
             content=body_str,
@@ -143,7 +162,7 @@ def query_transfer(out_bill_no: str) -> dict:
         "Authorization": _build_authorization("GET", path, ""),
         "Accept": "application/json",
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.get(
             f"{_API_HOST}{path}", headers=headers, timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC
         )
@@ -159,7 +178,7 @@ def cancel_transfer(out_bill_no: str) -> dict:
         "Accept": "application/json",
         "Content-Type": "application/json",
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.post(
             f"{_API_HOST}{path}", headers=headers, timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC
         )
@@ -171,16 +190,17 @@ def code_to_userinfo(code: str) -> dict:
     返回 {openid, nickname, avatar_url, raw}。失败抛 ValueError。
     注意:微信隐私新政下,部分 app 的 sns/userinfo 可能返回脱敏值(昵称"微信用户"/灰头像);
     nickname/avatar_url 可能为空,调用方需兜底。"""
-    r1 = httpx.get(
-        "https://api.weixin.qq.com/sns/oauth2/access_token",
-        params={
-            "appid": settings.WECHAT_APP_ID,
-            "secret": settings.WECHAT_APP_SECRET,
-            "code": code,
-            "grant_type": "authorization_code",
-        },
-        timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC,
-    )
+    with _http_client() as client:
+        r1 = client.get(
+            "https://api.weixin.qq.com/sns/oauth2/access_token",
+            params={
+                "appid": settings.WECHAT_APP_ID,
+                "secret": settings.WECHAT_APP_SECRET,
+                "code": code,
+                "grant_type": "authorization_code",
+            },
+            timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC,
+        )
     d1 = r1.json()
     if "openid" not in d1 or "access_token" not in d1:
         raise ValueError(f"微信授权失败: {d1.get('errmsg', d1)}")
@@ -191,11 +211,12 @@ def code_to_userinfo(code: str) -> dict:
     raw: dict = {}
     # userinfo 拉取失败不应让绑定失败(openid 已拿到),吞掉异常只是没昵称头像
     try:
-        r2 = httpx.get(
-            "https://api.weixin.qq.com/sns/userinfo",
-            params={"access_token": d1["access_token"], "openid": openid, "lang": "zh_CN"},
-            timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC,
-        )
+        with _http_client() as client:
+            r2 = client.get(
+                "https://api.weixin.qq.com/sns/userinfo",
+                params={"access_token": d1["access_token"], "openid": openid, "lang": "zh_CN"},
+                timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC,
+            )
         raw = r2.json()
         nickname = raw.get("nickname") or None
         avatar_url = raw.get("headimgurl") or None
@@ -244,7 +265,7 @@ def apply_transfer_authorization(
         "Accept": "application/json",
         "Content-Type": "application/json",
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.post(
             f"{_API_HOST}{_AUTH_PATH}",
             content=body_str,
@@ -262,7 +283,7 @@ def query_transfer_authorization(out_authorization_no: str) -> dict:
         "Authorization": _build_authorization("GET", path, ""),
         "Accept": "application/json",
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.get(
             f"{_API_HOST}{path}", headers=headers, timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC
         )
@@ -277,7 +298,7 @@ def close_transfer_authorization(out_authorization_no: str) -> dict:
         "Accept": "application/json",
         "Content-Type": "application/json",
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.post(
             f"{_API_HOST}{path}", headers=headers, timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC
         )
@@ -319,7 +340,7 @@ def pre_transfer_with_authorization(
         "Content-Type": "application/json",
         "Wechatpay-Serial": settings.WXPAY_PUBLIC_KEY_ID,
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.post(
             f"{_API_HOST}{_PRE_TRANSFER_AUTH_PATH}",
             content=body_str,
@@ -356,7 +377,7 @@ def transfer_with_authorization(
         "Content-Type": "application/json",
         "Wechatpay-Serial": settings.WXPAY_PUBLIC_KEY_ID,
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.post(
             f"{_API_HOST}{_TRANSFER_WITH_AUTH_PATH}",
             content=body_str,