fix: 签名参数字典序排列 + hex 编码处理 Java 有符号 byte

- nonce_str 应在 out_order_no 之前（n < o），之前错误放在最后
- byte & 0xFF 转无符号，防止负值输出 8 位 hex 而非 2 位

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

haha-service/src/main/java/com/haha/service/payment/payscore/impl/PayScoreServiceImpl.java

@@ -914,13 +914,13 @@ public class PayScoreServiceImpl implements PayScoreService {
         String nonceStr = generateNonceStr(32);
         String signType = "HMAC-SHA256";
 
-        // 按 key 字典序拼接: mch_id\nout_order_no\nservice_id\nsign_type\ntimestamp\nnonce_str\n
+        // 按 key 字典序拼接: mch_id, nonce_str, out_order_no, service_id, sign_type, timestamp
         String signMessage = "mch_id=" + wxPayConfig.getMchId() + "&"
+                + "nonce_str=" + nonceStr + "&"
                 + "out_order_no=" + outTradeNo + "&"
                 + "service_id=" + wxPayConfig.getServiceId() + "&"
                 + "sign_type=" + signType + "&"
-                + "timestamp=" + timestamp + "&"
-                + "nonce_str=" + nonceStr;
+                + "timestamp=" + timestamp;
 
         String sign;
         try {
@@ -930,9 +930,10 @@ public class PayScoreServiceImpl implements PayScoreService {
             mac.init(secretKey);
             byte[] signBytes = mac.doFinal(signMessage.getBytes(StandardCharsets.UTF_8));
             // openBusinessView 签名要求大写十六进制，不是 Base64
+            // byte 转无符号防止负值输出 8 位 hex
             StringBuilder sb = new StringBuilder();
             for (byte b : signBytes) {
-                sb.append(String.format("%02X", b));
+                sb.append(String.format("%02X", b & 0xFF));
             }
             sign = sb.toString();
         } catch (Exception e) {