feat: 提现审核按俱乐部隔离并加固打款商户号，新增小溪审核目录复制脚本

Co-authored-by: Cursor <cursoragent@cursor.com>

jituan/services/wechat_pay.py

@@ -396,21 +396,27 @@ def get_wechat_v3_config(club_id=None):
 
     # 共用商户的俱乐部：默认用 settings 私钥；仅当库中路径存在且文件在盘上才覆盖
     # （避免旧库里曾填过、但原先被忽略的无效路径突然接管提现）
-    private_key_path = path_defaults['PRIVATE_KEY_PATH']
-    if cid not in SHARED_WX_MERCHANT_CLUBS:
-        private_key_path = (
-            _pick_club_field(club, cfg_json, 'private_key_path')
-            or private_key_path
+    # 非共享俱乐部：严禁回落星阙私钥/商户，缺配置直接空值，由上层拒绝打款
+    if cid in SHARED_WX_MERCHANT_CLUBS:
+        private_key_path = path_defaults['PRIVATE_KEY_PATH']
+        if club:
+            uploaded_key = (getattr(club, 'private_key_path', None) or '').strip()
+            if uploaded_key and os.path.isfile(uploaded_key):
+                private_key_path = uploaded_key
+        platform_cert_dir = (
+            _pick_club_field(club, cfg_json, 'platform_cert_dir')
+            or path_defaults['PLATFORM_CERT_DIR']
         )
-    elif club:
-        uploaded_key = (getattr(club, 'private_key_path', None) or '').strip()
-        if uploaded_key and os.path.isfile(uploaded_key):
-            private_key_path = uploaded_key
+    else:
+        private_key_path = _pick_club_field(club, cfg_json, 'private_key_path')
+        platform_cert_dir = _pick_club_field(club, cfg_json, 'platform_cert_dir')
+        if not mch_id or not api_v3_key or not private_key_path:
+            logger.error(
+                '[WX_V3_CONFIG] club=%s 提现商户配置不完整(mch=%s key=%s pem=%s)，'
+                '禁止回落星阙商户，避免串号打款',
+                cid, bool(mch_id), bool(api_v3_key), bool(private_key_path),
+            )
 
-    platform_cert_dir = (
-        _pick_club_field(club, cfg_json, 'platform_cert_dir')
-        or path_defaults['PLATFORM_CERT_DIR']
-    )
     transfer_scene_id = (
         _pick_club_field(club, cfg_json, 'transfer_scene_id', 'TRANSFER_SCENE_ID')
         or path_defaults['TRANSFER_SCENE_ID']