feat: add direct PostgreSQL and ACK deployment support

tests/billing.test.ts

@@ -29,8 +29,7 @@ describe("organization billing", () => {
     runtimeDir = await mkdtemp(join(tmpdir(), "zhinian-billing-"));
     vi.stubEnv("ZHINIAN_RUNTIME_DIR", runtimeDir);
     vi.stubEnv("ZHINIAN_BILLING_REQUIRED", "1");
-    vi.stubEnv("NEXT_PUBLIC_SUPABASE_URL", "");
-    vi.stubEnv("SUPABASE_SERVICE_ROLE_KEY", "");
+    vi.stubEnv("ZHINIAN_DATA_BACKEND", "local");
   });
 
   afterEach(async () => {
@@ -433,7 +432,8 @@ describe("organization billing", () => {
       accountId: "user-1",
       jobId: job.id,
       idempotencyKey: `job-charge:${job.id}`,
-      description: "重复扣费"
+      description: "重试时更新的审计文案",
+      metadata: { retry: true }
     })).entry.id).toBe(charged.billing?.ledgerEntryId);
 
     const failed = await updateGenerationJob(charged.id, { status: "failed" });
@@ -445,6 +445,41 @@ describe("organization billing", () => {
     expect(ledger[0].balanceAfterFen).toBe(1000);
   });
 
+  it("scopes local wallet idempotency by organization and rejects payload drift", async () => {
+    const first = await postWalletEntry({
+      organizationId: "org-1",
+      kind: "recharge",
+      deltaFen: 100,
+      idempotencyKey: "shared-key",
+      description: "same request"
+    });
+    const otherOrganization = await postWalletEntry({
+      organizationId: "org-2",
+      kind: "recharge",
+      deltaFen: 100,
+      idempotencyKey: "shared-key",
+      description: "same request"
+    });
+
+    expect(otherOrganization.entry.id).not.toBe(first.entry.id);
+    const retried = await postWalletEntry({
+      organizationId: "org-1",
+      kind: "recharge",
+      deltaFen: 100,
+      idempotencyKey: "shared-key",
+      description: "updated audit label",
+      metadata: { retry: true }
+    });
+    expect(retried.entry.id).toBe(first.entry.id);
+    await expect(postWalletEntry({
+      organizationId: "org-1",
+      kind: "recharge",
+      deltaFen: 200,
+      idempotencyKey: "shared-key",
+      description: "same request"
+    })).rejects.toMatchObject({ status: 409 });
+  });
+
   it("blocks an ordinary generation before provider dispatch when the organization balance is insufficient", async () => {
     await createBillingPriceRule({
       id: "rule-insufficient-image",