全局配置更新：OAuth 回调修复、支付安全加固、站点 URL 工具

- 新增 NEXT_PUBLIC_SITE_URL 支持及 site-url.ts 工具模块
- 修复 OAuth 回调域名：import.meta.env 统一读取站点 URL
- 支付 API 路由新增收款地址校验
- 后端支付服务更新
- middleware 清理
- 新增 paymentSecurity 测试

frontend/lib/payment-receiver.ts

@@ -0,0 +1,19 @@
+export const EXPECTED_PAYMENT_RECEIVER_ADDRESS =
+  "0x351a1bca5f49dd0046a7cf0bafa7e12fa6441c3a";
+
+export function normalizePaymentReceiver(address: string | null | undefined) {
+  return String(address || "").trim().toLowerCase();
+}
+
+export function assertExpectedPaymentReceiver(
+  address: string | null | undefined,
+  label = "payment receiver",
+) {
+  const normalized = normalizePaymentReceiver(address);
+  if (normalized !== EXPECTED_PAYMENT_RECEIVER_ADDRESS) {
+    throw new Error(
+      `${label} mismatch: expected ${EXPECTED_PAYMENT_RECEIVER_ADDRESS}, got ${normalized || "empty"}`,
+    );
+  }
+  return normalized;
+}