fix: IAP 支付流程优化与关键 bug 修复

- getStatusLogic 类型断言修复（*user.User）
- restoreLogic 事务拆分为单条处理 + appAccountToken 解析
- attachTransactionLogic 提取 ParseProductIdDuration 共享函数
- 新增 config_helper.go 统一 Apple API 配置加载
- reconcileLogic 补充 BundleID 配置读取
- activateOrderLogic 邀请赠送天数逻辑完善

Co-Authored-By: claude-flow <ruv@ruv.net>

internal/model/order/model.go

@@ -104,7 +104,7 @@ func (m *customOrderModel) QueryOrderListByPage(ctx context.Context, page, size
 	return total, list, err
 }
 
-// UpdateOrderStatus Update order status
+// UpdateOrderStatus Update order status with state guard to prevent backward transitions
 func (m *customOrderModel) UpdateOrderStatus(ctx context.Context, orderNo string, status uint8, tx ...*gorm.DB) error {
 	orderInfo, err := m.FindOneByOrderNo(ctx, orderNo)
 	if err != nil {
@@ -114,7 +114,15 @@ func (m *customOrderModel) UpdateOrderStatus(ctx context.Context, orderNo string
 		if len(tx) > 0 {
 			conn = tx[0]
 		}
-		return conn.Model(&Order{}).Where("order_no = ?", orderNo).Update("status", status).Error
+		result := conn.Model(&Order{}).Where("order_no = ? AND status < ?", orderNo, status).Update("status", status)
+		if result.Error != nil {
+			return result.Error
+		}
+		if result.RowsAffected == 0 {
+			// Order already at or past the target status — idempotent success
+			return nil
+		}
+		return nil
 	}, m.getCacheKeys(orderInfo)...)
 }