fix(courier): parse XFX form-urlencoded track callbacks and raw ACK

Enable urlencoded body parser, return XFX {code,message} without API envelope, and harden callback payload parsing.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/callbacks/delivery-track.controller.ts

@@ -1,4 +1,5 @@
-import { Body, Controller, Param, Post } from '@nestjs/common';
+import { Body, Controller, Param, Post, Res } from '@nestjs/common';
+import type { Response } from 'express';
 import { DeliveryCallbackService } from './delivery-callback.service';
 
 @Controller('callbacks')
@@ -7,21 +8,28 @@ export class DeliveryCallbackController {
 
   /** 小飞侠/物流路由变化回调（适配器入口） */
   @Post('courier/:provider/track')
-  trackByProvider(@Param('provider') provider: string, @Body() body: unknown) {
-    return this.deliveryCallbackService.handleTrackCallback(
+  async trackByProvider(
+    @Param('provider') provider: string,
+    @Body() body: unknown,
+    @Res() res: Response,
+  ) {
+    const result = await this.deliveryCallbackService.handleTrackCallback(
       provider,
       body,
       `/api/v1/callbacks/courier/${provider}/track`,
     );
+    // 直出承运商约定结构，避免被全局 { code:0, data } 包装
+    return res.status(200).json(result);
   }
 
   /** 兼容旧路径，默认按小飞侠解析 */
   @Post('delivery/track')
-  trackLegacy(@Body() body: unknown) {
-    return this.deliveryCallbackService.handleTrackCallback(
+  async trackLegacy(@Body() body: unknown, @Res() res: Response) {
+    const result = await this.deliveryCallbackService.handleTrackCallback(
       'xfx',
       body,
       '/api/v1/callbacks/delivery/track',
     );
+    return res.status(200).json(result);
   }
 }