全局配置更新：OAuth 回调修复、支付安全加固、站点 URL 工具

- 新增 NEXT_PUBLIC_SITE_URL 支持及 site-url.ts 工具模块
- 修复 OAuth 回调域名：import.meta.env 统一读取站点 URL
- 支付 API 路由新增收款地址校验
- 后端支付服务更新
- middleware 清理
- 新增 paymentSecurity 测试

frontend/app/auth/callback/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { createSupabaseRouteClient, hasSupabaseServerEnv } from "@/lib/supabase/server";
+import { getConfiguredSiteUrl } from "@/lib/site-url";
 
 function normalizeNextPath(input: string | null) {
   const fallback = "/";
@@ -11,6 +12,16 @@ function normalizeNextPath(input: string | null) {
 }
 
 export async function GET(request: NextRequest) {
+  const configuredSiteUrl = getConfiguredSiteUrl();
+  if (configuredSiteUrl) {
+    const canonicalOrigin = new URL(configuredSiteUrl).origin;
+    if (request.nextUrl.origin !== canonicalOrigin) {
+      const canonicalCallbackUrl = new URL(request.nextUrl.pathname, canonicalOrigin);
+      canonicalCallbackUrl.search = request.nextUrl.search;
+      return NextResponse.redirect(canonicalCallbackUrl);
+    }
+  }
+
   const nextPath = normalizeNextPath(request.nextUrl.searchParams.get("next"));
   const redirectUrl = request.nextUrl.clone();
   redirectUrl.pathname = nextPath;
@@ -29,4 +40,3 @@ export async function GET(request: NextRequest) {
 
   return response;
 }
-