feat(settlement): 门店未出账手动提现与总部审核（OPT-010）

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/common/guards/shop-primary.guard.ts

@@ -0,0 +1,30 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.module';
+import type { AuthUser } from './jwt-auth.guard';
+
+/** 门店主账号专用（提现等资金操作） */
+@Injectable()
+export class ShopPrimaryGuard implements CanActivate {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const req = context.switchToHttp().getRequest();
+    const user = req.user as AuthUser | undefined;
+    if (!user || user.actorType !== 'STORE') {
+      throw new ForbiddenException('仅门店主账号可操作');
+    }
+    const account = await this.prisma.storeAccount.findUnique({
+      where: { id: user.actorId },
+      select: { isPrimary: true },
+    });
+    if (!account || account.isPrimary !== 1) {
+      throw new ForbiddenException('仅门店主账号可申请提现');
+    }
+    return true;
+  }
+}