fix(admin): show the real default URL for level and VIP icons

用户等级配置的「等级图标 URL」和 VIP 的「会员图标」在后台显示为空白输入框，
但前台实际渲染的是主题自带图标——后台既看不到当前效果，也无法判断该字段
是否已被配置。根因是 schema default 写成空串，而运行时（Level::
get_level_icon_url() / PaymentRuntime::get_vip_icon_url()）在值为空时回退
到 assets/img 下的内置图标。

把 schema default 改为直接写入主题自带图标 URL，与运行时回退链保持同一路径、
同一 is_file 守卫：后台展示的就是前台真正使用的图标，清空则回到文本/FA 回退。

- SchemaUsers::default_level_options()：icon_img_N 写入 user-level-N.png
- SchemaPayment::vip_icon_default()：vip_N_img_icon 写入 user/vip/vip-N.svg
- level.js / vip.js 同步默认值，help 与 placeholder 文案改为描述默认图标
- 两个测试 harness 补齐 get_theme_file_uri/path stub（schema 现在需要它们）

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tools/admin-contract-report.json

@@ -1,5 +1,5 @@
 {
-    "generated_at": "2026-11-01T15:59:01+00:00",
+    "generated_at": "2026-11-02T06:04:33+00:00",
     "errors": [],
     "warnings": [
         "customPage tools-update section 'tools/update' not in PHP schema (ok if pure operational page)",
@@ -258,36 +258,36 @@
         "entry": true,
         "missing_chunks": [],
         "chunks": [
-            "SchemaPage.D4P-9DC7.js",
+            "SchemaPage.D9mbKGcx.js",
             "vendor-vue.CibbKclz.js",
             "FaIcon.DB-L86Cm.js",
             "useCollapsibleItems.DZpGrxDC.js",
             "vendor-draggable.CJPlJ2VA.js",
-            "FaIconPicker.DNtVCp22.js",
+            "FaIconPicker.BAwAiMfQ.js",
             "shared-api.CBZ9FiMu.js",
             "vendor-misc.DkFG_sHo.js",
             "JioColorPicker.QfaAsnV3.js",
             "sortable-options.CCWOkUQx.js",
-            "level.E3ANSDAX.js",
+            "level.BzX407It.js",
             "badge.on0sWygn.js",
             "vendor-naive.Dfu2WQKq.js",
             "DeferredPage._-8ZQ7kA.js",
-            "NativeOpsRedirect.B2wZEyUo.js",
-            "FloatingButtonsSettings.DVBbYPoJ.js",
+            "NativeOpsRedirect.zFnHF1SN.js",
+            "FloatingButtonsSettings.DOwK-RTG.js",
             "PageHeader.nyzEkEki.js",
-            "FooterTabbarSettings.DlI0p5W6.js",
-            "PostPageSettings.Bz4V1oqX.js",
-            "CommentSettings.By49_Xcw.js",
+            "FooterTabbarSettings.tb4NL7kN.js",
+            "PostPageSettings.BIi2DEZC.js",
+            "CommentSettings.B-GZllSB.js",
             "PermissionsCapabilities.DqpqZWmL.js",
             "CmsCredits.B6Gorymm.js",
             "ThemeInfoPage.D4pAf5Wr.js",
             "ThemeAuthorizationPage.dha7vRbS.js",
             "DocsPage.Vq5ivh2L.js",
             "UsersVerify.DQdIZBGv.js",
-            "UsersLevel.DGq7yorC.js",
+            "UsersLevel.9dYF2o-O.js",
             "UsersBadge.CDPcEJ-D.js",
             "UsersWechatTemplate.CCecYMLT.js",
-            "UsersTicket.BFOcGa-7.js",
+            "UsersTicket.DnG1wULZ.js",
             "ToolsImportExport.BxHqqdz0.js",
             "ToolsHealth.DrJqHumh.js",
             "ToolsUpdate.rL8TduLs.js"