feat: native purchase + payments (Epay/TokenPay)

[DuckyProject]

What

Adds a full “native purchase” payment flow for self-hosted Sub2API deployments:

• Product (subscription / balance) -> create order -> redirect pay_url -> provider callback verification -> automatic fulfillment
• Providers: Epay and TokenPay

Highlights

Backend

• DB schema + migrations for:
  • payment_products / payment_orders / payment_notifications
  • entitlement_events (audit)
• Provider integration:
  • Epay: gateway root URL auto-appends submit.php when needed
  • TokenPay: generic gateway URL support
  • MD5 signature verification, normalized notify parsing, idempotency via notification event_id + order locking
• Public callback endpoint:
  • GET/POST /api/v1/payments/notify/:provider (some gateways use GET)
• Entitlement fulfillment:
  • subscription: auto assign/extend
  • balance: auto credit

Admin UI

• New admin pages:
  • /admin/payment-products (manage products)
  • /admin/payment-orders (view orders + notify events)
• Settings validation:
  • purchase_subscription_mode: disabled / iframe / native (backward compatible)
  • payment_enabled=true requires at least one fully configured provider

User UI

• /purchase native page:
  • choose provider + product
  • supports subscription packages + balance top-ups
  • custom amount top-up with min/max and suggested amounts
  • copy/open pay_url and refresh order status

Config keys

• public_base_url (required for callback URL building)
• purchase_subscription_mode=native
• payment_enabled=true
• Epay:
  • payment_epay_enabled=true
  • payment_epay_gateway_url
  • payment_epay_pid
  • payment_epay_key (MD5)
• TokenPay:
  • payment_tokenpay_enabled=true
  • payment_tokenpay_gateway_url
  • payment_tokenpay_merchant_id
  • payment_tokenpay_key (MD5)
• Optional: payment_balance_exchange_rate

How to test

Backend:

• cd backend && go test ./...
  Frontend:
• cd frontend && npm run typecheck && npm run test:run && npm run lint:check

Docs:

• Updated README / README_CN with setup + callback notes.

[Wei-Shaw]

感谢PR，暂不考虑集成支付能力。