增加支付逻辑

.env.example

@@ -20,6 +20,24 @@ ZHINIAN_BILLING_ACCOUNT_NAME=
 ZHINIAN_BILLING_ACCOUNT_BANK=
 ZHINIAN_BILLING_ACCOUNT_NUMBER=
 ZHINIAN_BILLING_CONTACT=
+
+# Optional WeChat Native recharge. Keep false until 0007 migration, credentials,
+# Native permission and the authenticated mini-program/service-account AppID binding are ready.
+# Server only; never use NEXT_PUBLIC_ names for payment credentials.
+WECHAT_PAY_ENABLED=false
+WECHAT_PAY_MCH_ID=
+WECHAT_PAY_APP_ID=
+WECHAT_PAY_NOTIFY_URL=https://YOUR_DOMAIN/api/payments/wechat/notify
+WECHAT_PAY_MERCHANT_SERIAL=
+WECHAT_PAY_API_V3_KEY=
+WECHAT_PAY_PUBLIC_KEY_ID=
+# PKCS#8 merchant private key and WeChat payment public key (PEM files).
+# File paths are relative to the Go process/container. *_PEM inline values are also supported.
+WECHAT_PAY_PRIVATE_KEY_FILE=
+WECHAT_PAY_PUBLIC_KEY_FILE=
+WECHAT_PAY_MIN_AMOUNT_FEN=100
+WECHAT_PAY_MAX_AMOUNT_FEN=1000000
+WECHAT_PAY_PRESET_AMOUNTS_FEN=10000,50000,100000
 # Run `npm run bootstrap:admin -- --phone 13800138000 --password 'change-me-now'` once to create the first super admin.
 
 # Public API v1 and worker task management.
@@ -45,7 +63,15 @@ ZHINIAN_GO_EMBEDDED_WORKER=true
 # an explicitly non-production single-process development run.
 ZHINIAN_DATA_BACKEND=postgres
 DATABASE_URL=
-# Migration runner only: PostgreSQL role used by the Go API DATABASE_URL.
+# Optional Go startup migration. ACK enables this with a separate Secret;
+# default false for local/Compose. Keep the migration role's URL server-side.
+# ACK/Compose inject environment variables; direct `go run` needs explicit
+# exported variables and does not load these database startup flags from here.
+DATABASE_AUTO_MIGRATE=false
+DATABASE_MIGRATION_URL=
+DATABASE_MIGRATION_TIMEOUT_SECONDS=180
+# PostgreSQL role used by the Go API DATABASE_URL; startup and manual migration
+# grant new tables/functions to this role.
 DATABASE_APP_ROLE=
 # PostgreSQL transport is intentionally plaintext; clients force sslmode=disable.
 # Example: postgresql://user:password@rds-host:5432/app?sslmode=disable