全局配置更新：OAuth 回调修复、支付安全加固、站点 URL 工具

- 新增 NEXT_PUBLIC_SITE_URL 支持及 site-url.ts 工具模块
- 修复 OAuth 回调域名：import.meta.env 统一读取站点 URL
- 支付 API 路由新增收款地址校验
- 后端支付服务更新
- middleware 清理
- 新增 paymentSecurity 测试

frontend/lib/backend-auth.ts

@@ -94,4 +94,13 @@ export function applyAuthResponseCookies(
   return target;
 }
 
-
+export function requireBackendAuthUser(auth: HeaderBuildResult) {
+  if (auth.authUserId) return null;
+  return applyAuthResponseCookies(
+    NextResponse.json(
+      { error: "Authentication required", detail: "Supabase user required" },
+      { status: 401 },
+    ),
+    auth.response,
+  );
+}

frontend/lib/payment-receiver.ts

@@ -0,0 +1,19 @@
+export const EXPECTED_PAYMENT_RECEIVER_ADDRESS =
+  "0x351a1bca5f49dd0046a7cf0bafa7e12fa6441c3a";
+
+export function normalizePaymentReceiver(address: string | null | undefined) {
+  return String(address || "").trim().toLowerCase();
+}
+
+export function assertExpectedPaymentReceiver(
+  address: string | null | undefined,
+  label = "payment receiver",
+) {
+  const normalized = normalizePaymentReceiver(address);
+  if (normalized !== EXPECTED_PAYMENT_RECEIVER_ADDRESS) {
+    throw new Error(
+      `${label} mismatch: expected ${EXPECTED_PAYMENT_RECEIVER_ADDRESS}, got ${normalized || "empty"}`,
+    );
+  }
+  return normalized;
+}

frontend/lib/site-url.ts

@@ -0,0 +1,7 @@
+export const PRODUCTION_SITE_URL = "https://polyweather-pro.vercel.app";
+
+export function getConfiguredSiteUrl() {
+  const configured = process.env.NEXT_PUBLIC_SITE_URL?.trim();
+  if (configured) return configured;
+  return process.env.NODE_ENV === "production" ? PRODUCTION_SITE_URL : "";
+}