fix(admin,partner): harden Tencent locpicker coords and confirm flow

Accept latlng-only postMessage, confirm before apply, and read LBS key per request.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/integrations/map/tencent-lbs.provider.ts

@@ -23,12 +23,16 @@ function normalizeCityName(name: string) {
 @Injectable()
 export class TencentLbsProvider {
   private readonly logger = new Logger(TencentLbsProvider.name);
-  private readonly config = loadAppConfig();
 
   constructor(private readonly prisma: PrismaService) {}
 
+  /** 每次读取，避免构造时缓存、以及系统设置热更新后仍用旧 Key */
+  private getLbsKey() {
+    return (loadAppConfig().tencentLbsKey || '').trim();
+  }
+
   isEnabled() {
-    return !!this.config.tencentLbsKey;
+    return !!this.getLbsKey();
   }
 
   /** 地址 → 坐标（正向地理编码） */
@@ -61,7 +65,7 @@ export class TencentLbsProvider {
 
     const url = new URL('https://apis.map.qq.com/ws/geocoder/v1/');
     url.searchParams.set('address', trimmed);
-    url.searchParams.set('key', this.config.tencentLbsKey);
+    url.searchParams.set('key', this.getLbsKey());
 
     try {
       const res = await fetch(url.toString());
@@ -140,7 +144,7 @@ export class TencentLbsProvider {
     const location = `${latitude},${longitude}`;
     const url = new URL('https://apis.map.qq.com/ws/geocoder/v1/');
     url.searchParams.set('location', location);
-    url.searchParams.set('key', this.config.tencentLbsKey);
+    url.searchParams.set('key', this.getLbsKey());
     url.searchParams.set('get_poi', '0');
 
     try {