feat(affiliate): attribution modes, settlement hardening, trusted proxies, QR and poster

- 归因模式可配置（first_touch/last_touch）、停佣开关、懒结算与佣金基数降级复查
- aksrt_get_client_ip 接入 aksrt_trusted_proxies 信任代理名单，防 CDN 头伪造
- 收益页 Canvas 二维码 + 750x1000 推广海报（本地打包 qrcode.min.js，无 CDN）
- 契约测试固化归因/海报/信任代理链路

src/Admin/Schema/SchemaPayment.php

@@ -312,6 +312,10 @@ class SchemaPayment {
 							]],
 							['key' => 'pay_rebate_show_users', 'label' => '用户中心显示我推荐的用户', 'type' => 'switch', 'default' => true, 'dependsOn' => ['key' => 'pay_rebate_judgment', 'value' => 'all']],
 							['key' => 'pay_rebate_self_s', 'label' => '自己推广自己', 'type' => 'switch', 'default' => true, 'dependsOn' => ['key' => 'pay_rebate_s', 'value' => true], 'help' => '允许使用自己的推广链接购买商品并获得佣金'],
+							['key' => 'referral_attribution_model', 'label' => '推广归因模式', 'type' => 'radio', 'default' => 'first_touch', 'options' => [
+								['label' => '首次触点（首触优先）', 'value' => 'first_touch'],
+								['label' => '最近触点（末触覆盖）', 'value' => 'last_touch'],
+							], 'help' => '首触：访客首次通过推广链接进入后，归因固定且不被后续链接覆盖；末触：最近一次点击的推广码覆盖之前的归因'],
 						]],
 						['key' => 'rules', 'title' => '返佣规则', 'fields' => [
 							['key' => 'rebate_rule', 'label' => '为不同用户类型设置返佣规则', 'type' => 'tabbed', 'tabs' => [
@@ -344,6 +348,7 @@ class SchemaPayment {
 								]],
 							]],
 							['key' => 'affiliate_settlement_days', 'label' => '结算观察期(天)', 'type' => 'number', 'default' => 7, 'min' => 0, 'max' => 90, 'dependsOn' => ['key' => 'pay_rebate_s', 'value' => true], 'help' => '订单完成后经过观察期，佣金才会结算到可提现余额'],
+							['key' => 'affiliate_disabled_code_stops_commission', 'label' => '推广码禁用后停止返佣', 'type' => 'switch', 'default' => false, 'dependsOn' => ['key' => 'pay_rebate_s', 'value' => true], 'help' => '开启后，推广者的推广码被禁用（或缺失）时，其名下已绑定用户的新订单不再产生佣金；关闭则绑定关系继续生效'],
 						]],
 						['key' => 'text', 'title' => '返佣文案', 'fields' => [
 							['key' => 'pay_rebate_text_desc', 'label' => '返佣文案（一句话简介）', 'type' => 'input', 'default' => '加入分享计划，获得高额奖励', 'dependsOn' => ['key' => 'pay_rebate_s', 'value' => true]],