全局配置更新：OAuth 回调修复、支付安全加固、站点 URL 工具

- 新增 NEXT_PUBLIC_SITE_URL 支持及 site-url.ts 工具模块
- 修复 OAuth 回调域名：import.meta.env 统一读取站点 URL
- 支付 API 路由新增收款地址校验
- 后端支付服务更新
- middleware 清理
- 新增 paymentSecurity 测试

src/bot/orchestrator.py

@@ -81,8 +81,8 @@ def start_bot() -> None:
     startup_coordinator = StartupCoordinator(
         bot=bot,
         config=config,
-        command_access_mode="group_member_only",
-        protected_commands=["/city", "/deb"],
+        command_access_mode="public",
+        protected_commands=[],
         required_group_chat_id=",".join(get_telegram_chat_ids_from_env()),
     )
 
@@ -99,7 +99,7 @@ def start_bot() -> None:
     started_count = sum(1 for loop in runtime_status.loops if loop.started)
 
     logger.info(
-        "🤖 Bot 启动中... access=group-member-only protected_commands=/city,/deb loops_started={}/{}",
+        "🤖 Bot 启动中... access=public protected_commands=none loops_started={}/{}",
         started_count,
         len(runtime_status.loops),
     )