修复(#137): DeferCloseOrder 关单前反查支付网关

启用 confirmationPayment 作为关单兜底，对 status=1 订单反查 Alipay/Stripe/EPay
网关，三态分支处理：
  - 网关已收钱：不关单，订单进入 status=2 + 投递 ForthwithActivateOrder
  - 网关明确未支付/已取消：维持原 close 行为，置 status=3
  - 网关反查失败（超时/5xx/网络错）：保留 status=1，等下一次 DeferCloseOrder 重试

EPay 客户端 QueryOrderStatus 改为返回 (bool, error)，避免"未支付"与"查询失败"
混淆。Balance 等无网关方法保持 Unpaid 兜底，"用户主动取消"路径回归通过。

Co-authored-by: multica-agent <github@multica.ai>

pkg/payment/epay/epay.go

@@ -2,6 +2,7 @@ package epay
 
 import (
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"net/url"
@@ -88,28 +89,42 @@ func (c *Client) VerifySign(params map[string]string) bool {
 	return c.createSign(params) == params["sign"]
 }
 
-func (c *Client) QueryOrderStatus(orderNo string) bool {
+// QueryOrderStatus returns (paid, err). A non-nil err means the query itself
+// failed (network / 5xx / decode error) and the result is inconclusive — callers
+// MUST NOT treat that as "unpaid". A nil err with paid=false means the gateway
+// answered and reported the order is not paid.
+func (c *Client) QueryOrderStatus(orderNo string) (bool, error) {
 	client := http.Client{
 		Timeout: 5 * time.Second,
 	}
 	resp, err := client.Get(c.Url + "/api.php" + "?act=order" + "&pid=" + c.Pid + "&key=" + c.Key + "&out_trade_no=" + orderNo)
 	if err != nil {
 		logger.Error("[Epay] QueryOrderStatus error", logger.Field("orderNo", orderNo), logger.Field("error", err.Error()))
-		return false
+		return false, fmt.Errorf("epay query request failed: %w", err)
 	}
 	defer resp.Body.Close()
+	if resp.StatusCode >= 500 {
+		err := fmt.Errorf("epay query upstream status %d", resp.StatusCode)
+		logger.Error("[Epay] QueryOrderStatus upstream 5xx", logger.Field("orderNo", orderNo), logger.Field("status", resp.StatusCode))
+		return false, err
+	}
 	value, err := io.ReadAll(resp.Body)
 	if err != nil {
 		logger.Error("[Epay] QueryOrderStatus error", logger.Field("orderNo", orderNo), logger.Field("error", err.Error()))
-		return false
+		return false, fmt.Errorf("epay query read body failed: %w", err)
 	}
 	var response queryOrderStatusResponse
-	err = json.Unmarshal(value, &response)
-	if err != nil {
+	if err = json.Unmarshal(value, &response); err != nil {
 		logger.Error("[Epay] QueryOrderStatus error", logger.Field("orderNo", orderNo), logger.Field("error", err.Error()))
-		return false
+		return false, fmt.Errorf("epay query decode failed: %w", err)
 	}
-	return response.Status == 1
+	// EPay API contract: code != 1 means the API itself errored (e.g. wrong key).
+	// Treat it as a query failure, not a definitive "unpaid", to avoid wrongly
+	// closing a paid order under a transient upstream config error.
+	if response.Code != 1 {
+		return false, fmt.Errorf("epay query api code=%d msg=%q", response.Code, response.Msg)
+	}
+	return response.Status == 1, nil
 }
 
 // StructToMap converts a struct to map[string]string