PlatformOrder store: guard renewal must match subscription merchant/plan

app/Http/Controllers/Admin/PlatformOrderController.php

@@ -122,6 +122,30 @@ class PlatformOrderController extends Controller
             'lead_id' => ['nullable', 'integer', 'exists:platform_leads,id'],
         ]);
 
+        // 治理口径：续费单必须与订阅上下文一致（站点/套餐）。
+        // 当前阶段暂不支持“跨站点/跨套餐续费”，避免误续费/串单风险；升级/降级后续再单独建设。
+        if ((string) ($data['order_type'] ?? '') === 'renewal') {
+            $subId = (int) ($data['site_subscription_id'] ?? 0);
+            $sub = $subId > 0 ? SiteSubscription::query()->find($subId) : null;
+            if (! $sub) {
+                return redirect()->back()->withErrors([
+                    'site_subscription_id' => '续费单必须绑定有效订阅。',
+                ])->withInput();
+            }
+
+            if ((int) ($data['merchant_id'] ?? 0) !== (int) ($sub->merchant_id ?? 0)) {
+                return redirect()->back()->withErrors([
+                    'merchant_id' => '续费单站点必须与订阅所属站点一致（请从订阅维度进入下单）。',
+                ])->withInput();
+            }
+
+            if ((int) ($data['plan_id'] ?? 0) !== (int) ($sub->plan_id ?? 0)) {
+                return redirect()->back()->withErrors([
+                    'plan_id' => '续费单套餐必须与订阅当前套餐一致（当前阶段暂不支持跨套餐续费）。',
+                ])->withInput();
+            }
+        }
+
         $plan = Plan::query()->findOrFail((int) $data['plan_id']);
 
         $periodMonths = $this->periodMonthsFromBillingCycle((string) $plan->billing_cycle);