fix: 修复付费机制失效处理的5个后端缺口

- 新增POST /payment/refund-notify支付宝退款Webhook
- 新增待支付订单自动清理(超过24h→cancelled, 含启动清理)
- 新增web登录码过期启动清理
- 永久会员用NULL替代硬编码2099-12-31
- 修复缺失的is_paid_active数据库函数(改用内联SQL)

src/handlers/auth.rs

@@ -713,17 +713,22 @@ pub async fn web_login_auto_confirm(
         }
     };
 
-    let (is_paid_active, paid_expires_at): (bool, Option<String>) =
-        match sqlx::query_as::<_, (bool, Option<chrono::DateTime<chrono::Utc>>)>(
-            "SELECT is_paid_active($1)",
-        )
-        .bind(user_id)
-        .fetch_optional(pool.get_ref())
-        .await
-        {
-            Ok(Some((active, expires))) => (active, expires.map(|e| e.to_rfc3339())),
-            _ => (false, None),
-        };
+    let paid_info = sqlx::query_as::<_, (bool, Option<chrono::DateTime<chrono::Utc>>)>(
+        "SELECT is_paid, paid_expires_at FROM users WHERE id = $1",
+    )
+    .bind(user_id)
+    .fetch_optional(pool.get_ref())
+    .await
+    .ok()
+    .flatten();
+
+    let (is_paid_active, paid_expires_at): (bool, Option<String>) = match paid_info {
+        Some((is_paid, expires)) => {
+            let active = is_paid && expires.map_or(true, |e| e > Utc::now());
+            (active, expires.map(|e| e.to_rfc3339()))
+        }
+        None => (false, None),
+    };
 
     let base_url = std::env::var("APP_BASE_URL")
         .unwrap_or_else(|_| "https://dev.xmclassmate.top".to_string());