feat(withdrawal): make payout channels a configurable sortable list

The payout channel was a two-item checkbox (alipay / wechat). Sites that pay
out through a bank transfer, USDT or any other route had no way to express it,
and every surface behind it — the withdrawal modal, the server-side check, the
admin review list — hard-coded those two names.

affiliate_payout_channels is now a repeater on both the PHP and Vue schemas,
using the same draggable component as the post filters and gateway config. Each
row carries a stable key, a display label, an account placeholder, an optional
note and an enabled flag. Disabled channels disappear from the front end but
stay resolvable, so historical withdrawal records still render their original
name.

PaymentRuntime::payout_channels() normalises the stored structure: it drops rows
with an empty key or label, de-duplicates keys, and falls back to the built-in
two channels when nothing is configured. enabled_payout_channels() feeds the
front end and payout_channel() resolves a single key for record display.
CommissionLedger's validation now compares against the configured, enabled keys
instead of a literal allowlist.

The withdrawal modal renders the configured list and swaps the account
placeholder and note when the channel changes; credits.js drives that. The
admin review page reads the same settings for its method labels and filter, and
the review dialog gained a "渠道说明" row so the operator sees the payout
instruction, hidden when empty.

Default channels live in SchemaPayment as plain data — the runtime imports them
rather than the reverse, because the schema layer must not depend on a runtime
settings class (doing it the other way made the schema harness fatal).

Verification: drove payout_channels() through default / custom / dirty / duplicate
inputs and confirmed enabled filtering, note lookup and disabled-channel
resolution. Added payment-withdrawal-channels-contract.test.cjs covering the
schema shape, runtime helpers, front-end wiring and admin read path. 873 tests
pass, PSR-4 audit clean, admin SPA builds.

assets/js/admin-withdrawals.js

@@ -47,7 +47,16 @@
     });
     form.querySelector('[data-field="status"]').value = mode;
     dialog.querySelectorAll('[data-summary]').forEach(function (dd) {
-      dd.textContent = button.dataset[dd.getAttribute('data-summary')] || '—';
+      var raw = button.dataset[dd.getAttribute('data-summary')] || '';
+      // 渠道说明是可选的，留空时整行隐藏，不留一条破折号。
+      var row = dd.parentElement;
+      if (dd.getAttribute('data-summary') === 'method_note' && raw === '') {
+        if (row) row.hidden = true;
+        dd.textContent = '';
+        return;
+      }
+      if (row) row.hidden = false;
+      dd.textContent = raw || '—';
     });
     if (note) note.value = '';
     resetSubmits();

assets/js/credits.js

@@ -392,6 +392,26 @@
 		});
 		applyMethodVisibility((modal.querySelector('input[name="payment_method"]') || {}).value || '');
 		if (!form) return;
+		// 收款渠道由后台拖拽结构定义：切换时同步收款信息提示与渠道说明。
+		var methodField = form.querySelector('[data-jio-withdraw-method]');
+		var accountField = form.querySelector('[data-jio-withdraw-account]');
+		var noteField = form.querySelector('[data-jio-withdraw-note]');
+		function syncChannelHint() {
+			if (!methodField) return;
+			var option = methodField.options[methodField.selectedIndex];
+			if (!option) return;
+			var hint = option.getAttribute('data-hint') || '';
+			var note = option.getAttribute('data-note') || '';
+			if (accountField) accountField.setAttribute('placeholder', hint || '姓名 + 账户 / 卡号');
+			if (noteField) {
+				noteField.textContent = note;
+				noteField.hidden = note === '';
+			}
+		}
+		if (methodField) {
+			methodField.addEventListener('change', syncChannelHint);
+			syncChannelHint();
+		}
 		resetOperationKeyOnChange(form);
 		form.addEventListener('submit', function (e) {
 			e.preventDefault();