feat(after-sale): 售后面板新增「标记订单已退款」勾选项

展开的操作面板在状态下拉与备注旁新增「标记订单已退款」勾选框：勾选后点击确认，会先把关联订单推到已退款，再更新售后工单状态。订单本已退款时勾选框呈现为不可改的已选状态，且不提交该标记。

顺序不能反：OrderRepository::update_status 的退款闸门要求售后工单仍为待审核/处理中，一旦 set_status 先执行就不再放行。因此退款失败时整次操作中止，避免出现「工单已关、订单未退」的半完成状态。订单号由服务端按 after_sale_id 反查，不经客户端传递。

AfterSaleService::get() 由 private 改为 public 以支撑该反查。dev harness 扩展为可驱动 handler 的六个场景，覆盖勾选/未勾选、重复退款、非已支付订单、已关闭工单与非法状态。

tests/widget-system/financial-flow-contract.test.cjs

@@ -158,6 +158,23 @@ test('order detail page drops tabs; after-sales becomes a standalone submenu', (
   assert.ok(page.includes('aksrt_after_sale_status_'), 'per-row nonce covers the status update')
   assert.ok(page.includes('aksrt-as-field--wide'), 'description renders as a full-width row')
   assert.ok(page.includes('justify-content:flex-end'), 'confirm/cancel buttons right-aligned')
+  // 「标记订单已退款」：勾选后确认时把关联订单推到已退款
+  assert.ok(page.includes('aksrt-mark-order-refunded'), 'refund checkbox inside expanded panel')
+  assert.ok(page.includes('标记订单已退款'), 'refund checkbox label')
+  assert.ok(page.includes('mark_order_refunded:markRefund?"1":""'), 'refund flag posted only when checked')
+  assert.ok(page.includes('var markRefund=!!(refundEl&&refundEl.checked&&!refundEl.disabled);'),
+    'a disabled (already refunded) checkbox submits nothing')
+  assert.ok(page.includes('aksrt-as-refund-flag'), 'refund checkbox keeps its own row in the panel')
+  // 订单退款必须早于售后状态更新：工单一离开 pending/processing，OrderRepository 的退款闸门就不再放行
+  assert.ok(page.indexOf('mark_related_order_refunded($id)') < page.indexOf('set_status($id'),
+    'order refund runs before the after-sale status update')
+  assert.ok(page.includes('DomainModel::ORDER_STATUS_REFUNDED'), 'refund marking targets the refunded order status')
+  assert.ok(page.includes("'allow_refund'  => true"), 'refund opts into the guarded transition')
+  assert.ok(page.includes("'after_sale_id' => $after_sale_id"), 'refund is bound to this after-sale application')
+  assert.ok(page.includes('after_sale_order_refund_failed'), 'refund failure is reported to the admin')
+  assert.ok(page.includes('after_sale_updated_order_refunded'), 'refund success is reported to the admin')
+  const service = read('src/Payment/AfterSaleService.php')
+  assert.match(service, /public function get\(int \$id\)/, 'after-sale lookup is exposed for the admin handler')
   assert.ok(page.includes('.aksrt-as-detail-row[hidden]'), 'hidden attribute guard keeps accordion closed')
   assert.ok(page.includes('document.addEventListener("click"'), 'delegated click handler survives row re-render')
   assert.ok(!page.includes('class="row-actions"'), 'no hover-only row-actions')