feat(settlement): 门店未出账手动提现与总部审核（OPT-010）

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/common/guards/shop-primary.guard.ts

@@ -0,0 +1,30 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.module';
+import type { AuthUser } from './jwt-auth.guard';
+
+/** 门店主账号专用（提现等资金操作） */
+@Injectable()
+export class ShopPrimaryGuard implements CanActivate {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const req = context.switchToHttp().getRequest();
+    const user = req.user as AuthUser | undefined;
+    if (!user || user.actorType !== 'STORE') {
+      throw new ForbiddenException('仅门店主账号可操作');
+    }
+    const account = await this.prisma.storeAccount.findUnique({
+      where: { id: user.actorId },
+      select: { isPrimary: true },
+    });
+    if (!account || account.isPrimary !== 1) {
+      throw new ForbiddenException('仅门店主账号可申请提现');
+    }
+    return true;
+  }
+}

server/dukang-api/src/common/hq-operation/hq-operation.constants.ts

@@ -61,6 +61,8 @@ export const HqOperationAction = {
   STORE_PAYOUT_BATCH_CONFIRM: 'STORE_PAYOUT_BATCH_CONFIRM',
   STORE_BILL_CONFIRM: 'STORE_BILL_CONFIRM',
   STORE_BILL_BATCH_CONFIRM: 'STORE_BILL_BATCH_CONFIRM',
+  STORE_WITHDRAW_APPROVE: 'STORE_WITHDRAW_APPROVE',
+  STORE_WITHDRAW_REJECT: 'STORE_WITHDRAW_REJECT',
   PARTNER_BILL_GENERATE: 'PARTNER_BILL_GENERATE',
   PARTNER_BILL_SEND: 'PARTNER_BILL_SEND',
   PARTNER_BILL_BATCH_SEND: 'PARTNER_BILL_BATCH_SEND',
@@ -164,6 +166,8 @@ export const HQ_OPERATION_ACTION_LABELS: Record<string, string> = {
   [HqOperationAction.STORE_PAYOUT_BATCH_CONFIRM]: '批量门店打款',
   [HqOperationAction.STORE_BILL_CONFIRM]: '门店对账单确认打款',
   [HqOperationAction.STORE_BILL_BATCH_CONFIRM]: '批量门店对账单打款',
+  [HqOperationAction.STORE_WITHDRAW_APPROVE]: '门店提现审核通过',
+  [HqOperationAction.STORE_WITHDRAW_REJECT]: '门店提现驳回',
   [HqOperationAction.PARTNER_BILL_GENERATE]: '生成合伙人账单',
   [HqOperationAction.PARTNER_BILL_SEND]: '发送合伙人账单',
   [HqOperationAction.PARTNER_BILL_BATCH_SEND]: '批量发送合伙人账单',

server/dukang-api/src/common/system-config/system-config.registry.ts

@@ -10,6 +10,7 @@ export const SYSTEM_CONFIG_GROUPS: SystemConfigGroupMeta[] = [
   { key: 'app', label: '应用链接' },
   { key: 'deploy', label: '发布部署' },
   { key: 'winery_bank', label: '酒厂银行账户' },
+  { key: 'finance', label: '财务结算' },
 ];
 
 const G = {
@@ -21,6 +22,7 @@ const G = {
   app: 'app',
   deploy: 'deploy',
   winery_bank: 'winery_bank',
+  finance: 'finance',
 } as const;
 
 /** HQ 可维护字段（不含 NODE_ENV / DATABASE_URL / JWT 等基础设施项） */
@@ -187,6 +189,15 @@ export const SYSTEM_CONFIG_FIELDS: SystemConfigFieldMeta[] = [
     type: 'string',
     requiresRestart: false,
   },
+  {
+    key: 'STORE_WITHDRAW_DAILY_LIMIT',
+    label: '门店未出账提现单日上限（元）',
+    group: G.finance,
+    type: 'number',
+    requiresRestart: false,
+    description: 'FIN-002：单店单日提现上限，默认 5000',
+    placeholder: '5000',
+  },
 ];
 
 /** 已从 HQ 配置移除、仅保留在 .env 的键（启动时从 DB 清理） */