fix(courier): parse XFX form-urlencoded track callbacks and raw ACK

Enable urlencoded body parser, return XFX {code,message} without API envelope, and harden callback payload parsing.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/main.ts

@@ -3,7 +3,7 @@ import { NestFactory } from '@nestjs/core';
 import { loadAppConfig } from '@dukang/shared-types';
 import { NestExpressApplication } from '@nestjs/platform-express';
 import { ValidationPipe } from '@nestjs/common';
-import { json } from 'express';
+import { json, urlencoded } from 'express';
 import { AppModule } from './app.module';
 import { HttpExceptionFilter } from './common/filters/http-exception.filter';
 import { ResponseInterceptor } from './common/interceptors/response.interceptor';
@@ -26,6 +26,7 @@ async function bootstrap() {
   app.setGlobalPrefix('api/v1');
   app.set('trust proxy', true);
   app.enableCors({ origin: true, credentials: true });
+  // 微信支付等需 rawBody；小飞侠回调多为 x-www-form-urlencoded
   app.use(
     json({
       verify: (req, _res, buf) => {
@@ -39,6 +40,7 @@ async function bootstrap() {
       },
     }),
   );
+  app.use(urlencoded({ extended: true }));
   app.useGlobalPipes(new ValidationPipe({ transform: true, whitelist: true }));
   app.useGlobalFilters(new HttpExceptionFilter(app.get(AlertService)));
   app.useGlobalInterceptors(new ResponseInterceptor(), app.get(LoggingInterceptor));