fix(admin,partner): harden Tencent locpicker coords and confirm flow

Accept latlng-only postMessage, confirm before apply, and read LBS key per request.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/.env.example

@@ -60,7 +60,9 @@ WX_PAY_NOTIFY_URL=https://api.dukanghaoke.com/api/v1/callbacks/wechat/pay
 WECOM_AIBOT_ENABLED=false
 
 # 腾讯位置服务（地理编码 / 逆地理 / 地图选点组件）
-# 地图选点需在控制台为 Key 配置域名白名单，并允许组件域名 apis.map.qq.com
+# 控制台须：1) 开启 WebServiceAPI（否则选点搜不到附近列表）
+# 2) WebService 域名白名单加入 apis.map.qq.com
+# 3) 浏览器 Key 按管理端 / 合伙人 H5 域名限制（可选）
 TENCENT_LBS_KEY=
 
 # 阿里云 OSS（ali-oss@6.x；凭证齐全时直传，缺失则服务端报错）

server/dukang-api/src/common/system-config/system-config.registry.ts

@@ -107,7 +107,7 @@ export const SYSTEM_CONFIG_FIELDS: SystemConfigFieldMeta[] = [
   { key: 'OSS_MAX_UPLOAD_BYTES', label: '单文件上限(字节)', group: G.oss, type: 'number', requiresRestart: false },
 
   { key: 'USER_H5_URL', label: 'C 端 H5 落地页', group: G.app, type: 'string', requiresRestart: false },
-  { key: 'TENCENT_LBS_KEY', label: '腾讯位置服务 Key（地理编码 / 地图选点）', group: G.app, type: 'password', secret: true, requiresRestart: false },
+  { key: 'TENCENT_LBS_KEY', label: '腾讯位置服务 Key（须开 WebServiceAPI；白名单含 apis.map.qq.com）', group: G.app, type: 'password', secret: true, requiresRestart: false },
 
   { key: 'DEPLOY_WEBHOOK_URL', label: '发布 Webhook URL', group: G.deploy, type: 'string', requiresRestart: false },
   { key: 'DEPLOY_WEBHOOK_SECRET', label: '发布 Webhook Secret', group: G.deploy, type: 'password', secret: true, requiresRestart: false },

server/dukang-api/src/integrations/map/tencent-lbs.provider.ts

@@ -23,12 +23,16 @@ function normalizeCityName(name: string) {
 @Injectable()
 export class TencentLbsProvider {
   private readonly logger = new Logger(TencentLbsProvider.name);
-  private readonly config = loadAppConfig();
 
   constructor(private readonly prisma: PrismaService) {}
 
+  /** 每次读取，避免构造时缓存、以及系统设置热更新后仍用旧 Key */
+  private getLbsKey() {
+    return (loadAppConfig().tencentLbsKey || '').trim();
+  }
+
   isEnabled() {
-    return !!this.config.tencentLbsKey;
+    return !!this.getLbsKey();
   }
 
   /** 地址 → 坐标（正向地理编码） */
@@ -61,7 +65,7 @@ export class TencentLbsProvider {
 
     const url = new URL('https://apis.map.qq.com/ws/geocoder/v1/');
     url.searchParams.set('address', trimmed);
-    url.searchParams.set('key', this.config.tencentLbsKey);
+    url.searchParams.set('key', this.getLbsKey());
 
     try {
       const res = await fetch(url.toString());
@@ -140,7 +144,7 @@ export class TencentLbsProvider {
     const location = `${latitude},${longitude}`;
     const url = new URL('https://apis.map.qq.com/ws/geocoder/v1/');
     url.searchParams.set('location', location);
-    url.searchParams.set('key', this.config.tencentLbsKey);
+    url.searchParams.set('key', this.getLbsKey());
     url.searchParams.set('get_poi', '0');
 
     try {