feat(pay): 商家转账场景 1005 打通提现打款

- 转账场景报备信息按佣金报酬要求固定传「岗位类型/报酬说明」两段，否则微信参数校验拒绝

- 处理 WAIT_USER_CONFIRM（用户确认模式）：推送「提现待你确认收款」，提示 24 小时内确认

- 提现申请增加单笔上限校验（finance_rules.maxWithdrawAmount，默认 200，对齐微信商家转账额度）

- /api/posts 身份优先取服务端会话 token

- 文档补充佣金报酬场景与用户确认模式说明（109 套件/722 用例全绿）

server/tests/secure-mode-gates.spec.ts

@@ -59,4 +59,18 @@ describe('第九十三批安全闸门解耦与支付 fail-closed', () => {
     expect(apiCode).toContain('const uid = normalizeUserId(userId);\n    let query = `?userId=${uid}`;');
     expect(apiCode).toContain('const uid = normalizeUserId(userId);\n    const payload = { userId: uid };');
   });
+
+  it('商家转账：待用户确认时必须提示收款人确认，并约束单笔额度', () => {
+    const review = routeBlock("app.post('/api/finance/withdrawals/:id/review'", 6000);
+    expect(review).toContain("state === 'WAIT_USER_CONFIRM'");
+    expect(review).toContain('提现待你确认收款');
+    const withdraw = routeBlock("app.post('/api/users/:id/withdraw'", 2500);
+    expect(withdraw).toContain('maxWithdrawAmount');
+    expect(withdraw).toContain('微信商家转账单笔限额');
+  });
+
+  it('动态列表身份优先取服务端会话', () => {
+    const posts = routeBlock("app.get('/api/posts'", 1200);
+    expect(posts).toContain('resolveRequestUserId(req)');
+  });
 });