修复(#137): DeferCloseOrder 关单前反查支付网关 (启用 confirmationPayment)

Squash merge of fix/137-defer-close-反查网关 (1367c4f).

DeferCloseOrder 直接将 status=1 订单关单，会把已经在网关侧完成支付但
notify 静默失败的订单错误关闭。本次在关单前调用 EPay 的网关查询接口
(confirmationPayment) 拿到三态结果：

- Paid: 原子化把 status 1->2，写回 trade_no，再投递 asynq 走激活流程
- Unpaid: 继续原来的 close 事务，把 status 改为 cancelled
- Unknown / 网关失败: 保持 status=1，下一轮 DeferClose 再试

新增 closeOrderLogic_test.go (232 行)，覆盖三态分支 + recoverPaidOrder
的并发幂等。单测全量 PASS, go build + go vet 均干净。E2E 验收因测试环境
访问受限暂未跑，QA 已在 issue 上注明阻塞原因 (qa_partial_blocked_on_e2e_access)。

Co-authored-by: multica-agent <github@multica.ai>

pkg/payment/epay/epay.go

@@ -2,6 +2,7 @@ package epay
 
 import (
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"net/url"
@@ -88,28 +89,42 @@ func (c *Client) VerifySign(params map[string]string) bool {
 	return c.createSign(params) == params["sign"]
 }
 
-func (c *Client) QueryOrderStatus(orderNo string) bool {
+// QueryOrderStatus returns (paid, err). A non-nil err means the query itself
+// failed (network / 5xx / decode error) and the result is inconclusive — callers
+// MUST NOT treat that as "unpaid". A nil err with paid=false means the gateway
+// answered and reported the order is not paid.
+func (c *Client) QueryOrderStatus(orderNo string) (bool, error) {
 	client := http.Client{
 		Timeout: 5 * time.Second,
 	}
 	resp, err := client.Get(c.Url + "/api.php" + "?act=order" + "&pid=" + c.Pid + "&key=" + c.Key + "&out_trade_no=" + orderNo)
 	if err != nil {
 		logger.Error("[Epay] QueryOrderStatus error", logger.Field("orderNo", orderNo), logger.Field("error", err.Error()))
-		return false
+		return false, fmt.Errorf("epay query request failed: %w", err)
 	}
 	defer resp.Body.Close()
+	if resp.StatusCode >= 500 {
+		err := fmt.Errorf("epay query upstream status %d", resp.StatusCode)
+		logger.Error("[Epay] QueryOrderStatus upstream 5xx", logger.Field("orderNo", orderNo), logger.Field("status", resp.StatusCode))
+		return false, err
+	}
 	value, err := io.ReadAll(resp.Body)
 	if err != nil {
 		logger.Error("[Epay] QueryOrderStatus error", logger.Field("orderNo", orderNo), logger.Field("error", err.Error()))
-		return false
+		return false, fmt.Errorf("epay query read body failed: %w", err)
 	}
 	var response queryOrderStatusResponse
-	err = json.Unmarshal(value, &response)
-	if err != nil {
+	if err = json.Unmarshal(value, &response); err != nil {
 		logger.Error("[Epay] QueryOrderStatus error", logger.Field("orderNo", orderNo), logger.Field("error", err.Error()))
-		return false
+		return false, fmt.Errorf("epay query decode failed: %w", err)
 	}
-	return response.Status == 1
+	// EPay API contract: code != 1 means the API itself errored (e.g. wrong key).
+	// Treat it as a query failure, not a definitive "unpaid", to avoid wrongly
+	// closing a paid order under a transient upstream config error.
+	if response.Code != 1 {
+		return false, fmt.Errorf("epay query api code=%d msg=%q", response.Code, response.Msg)
+	}
+	return response.Status == 1, nil
 }
 
 // StructToMap converts a struct to map[string]string