fix: C端钱包流水查询强制按登录用户过滤，修复 IDOR

- 原接口按 orderNo+type 直接查询，任意登录用户可传他人订单号
  查看其资金流水
- 新增 getWalletDetailByOrderNoForUser 方法强制 eq(userId)，
  AccountController 改用它；微信回调内部查询保持原方法
  （orderNo 为系统生成的强随机订单号，不可枚举）

Co-Authored-By: Claude <noreply@anthropic.com>

car-wash-miniapp/src/main/java/com/kym/miniapp/controller/AccountController.java

@@ -64,7 +64,8 @@ public class AccountController {
     @GetMapping("/walletDetail")
     public R<?> walletDetailList(@RequestParam(name = "type", defaultValue = "0", required = false) int type,
                                  @RequestParam(name = "orderNo", required = false) String orderNo) {
-        return R.success(walletDetailService.getWalletDetailByOrderNo(orderNo, type));
+        // 强制按登录用户过滤，防止通过订单号越权查看他人资金流水
+        return R.success(walletDetailService.getWalletDetailByOrderNoForUser(orderNo, type, StpUtil.getLoginIdAsLong()));
     }
 
     /**

car-wash-service/src/main/java/com/kym/service/WalletDetailService.java

@@ -20,6 +20,11 @@ public interface WalletDetailService extends MPJBaseService<WalletDetail> {
 
     WalletDetail getWalletDetailByOrderNo(String orderNo, Integer status);
 
+    /**
+     * C 端查询钱包流水：强制按用户过滤
+     */
+    WalletDetail getWalletDetailByOrderNoForUser(String orderNo, Integer type, Long userId);
+
     List<WalletDetail> listWalletDetail(int type);
 
     PageBean<WalletDetailVo> listAdminWalletDetail(WalletDetailQueryParam params);

car-wash-service/src/main/java/com/kym/service/impl/WalletDetailServiceImpl.java

@@ -31,6 +31,16 @@ public class WalletDetailServiceImpl extends MPJBaseServiceImpl<WalletDetailMapp
         return lambdaQuery().eq(WalletDetail::getOrderNo, orderNo).eq(WalletDetail::getType, type).one();
     }
 
+    @Override
+    public WalletDetail getWalletDetailByOrderNoForUser(String orderNo, Integer type, Long userId) {
+        // C 端查询：强制按用户过滤，防止通过订单号越权查看他人资金流水
+        return lambdaQuery()
+                .eq(WalletDetail::getOrderNo, orderNo)
+                .eq(WalletDetail::getType, type)
+                .eq(WalletDetail::getUserId, userId)
+                .one();
+    }
+
     @Override
     public List<WalletDetail> listWalletDetail(int type) {
         var userId = StpUtil.getLoginIdAsLong();