feat(after-sale): 支持撤销售后工单并接入人机验证

tests/widget-system/captcha-business-contract.test.cjs

@@ -61,3 +61,28 @@ test('legacy public SMS-code AJAX surface is removed while SMS service remains',
   assert.doesNotMatch(sms, /function ajax_send_code\s*\(/);
   assert.match(sms, /public function send_code\(string \$phone, string \$code\): array/);
 });
+
+test('after-sale submit and withdraw endpoints verify captcha once per request', () => {
+  const service = read('src/Payment/AfterSaleService.php');
+
+  // 两个新场景已在场景白名单与后台「启用场景」勾选列表同步注册
+  const scenes = read('inc/modules/captcha.php');
+  assert.match(scenes, /'after_sale_apply'\s*=> __\('申请售后', 'aksrt'\)/);
+  assert.match(scenes, /'after_sale_cancel'\s*=> __\('撤销售后', 'aksrt'\)/);
+  const permissions = read('src/Admin/Schema/SchemaPermissions.php');
+  assert.match(permissions, /'label' => '申请售后', 'value' => 'after_sale_apply'/);
+  assert.match(permissions, /'label' => '撤销售后', 'value' => 'after_sale_cancel'/);
+  const adminSchema = read('assets/admin/src/schema/sections/permissions/index.js');
+  assert.match(adminSchema, /label: '申请售后', value: 'after_sale_apply'/);
+  assert.match(adminSchema, /label: '撤销售后', value: 'after_sale_cancel'/);
+
+  // REST 提交 / 撤销各过一次场景校验（统一入口 helper 内恰一次 aksrt_require_captcha）；
+  // 场景未启用时 aksrt_require_captcha 直接放行
+  const submit = service.slice(service.indexOf('public function rest_submit'), service.indexOf('public function rest_list'));
+  const cancel = service.slice(service.indexOf('public function rest_cancel'), service.indexOf('public function create'));
+  assert.match(submit, /require_captcha\(\$request, 'after_sale_apply'\)/);
+  assert.match(cancel, /require_captcha\(\$request, 'after_sale_cancel'\)/);
+  assert.equal((service.match(/require_captcha\(\$request, '/g) || []).length, 2);
+  assert.equal((service.match(/aksrt_require_captcha\(/g) || []).length, 1);
+  assert.match(service, /function_exists\('aksrt_require_captcha'\)/);
+});