fix: handle literal \n in WX_MCH_PRIVATE_KEY env var

- Replace literal '\n' with real newlines when reading private key from env
- Add PEM header validation to catch format errors early
- File-based key (privateKeyPath) unaffected

server/src/lib/wxpay.js

@@ -11,10 +11,18 @@ function isConfigured() {
 let _cachedPrivateKey = null
 function getPrivateKey() {
   if (_cachedPrivateKey) return _cachedPrivateKey
-  if (config.wxpay.privateKey) { _cachedPrivateKey = config.wxpay.privateKey; return _cachedPrivateKey }
+  let key = ''
-  if (config.wxpay.privateKeyPath) { _cachedPrivateKey = fs.readFileSync(config.wxpay.privateKeyPath, 'utf8'); return _cachedPrivateKey }
+  if (config.wxpay.privateKey) {
+    key = config.wxpay.privateKey.replace(/\\n/g, '\n')
+  } else if (config.wxpay.privateKeyPath) {
+    key = fs.readFileSync(config.wxpay.privateKeyPath, 'utf8')
+  } else {
     throw new Error('WeChat Pay private key not configured')
   }
+  if (!key.includes('-----BEGIN')) throw new Error('Invalid private key format (missing PEM header)')
+  _cachedPrivateKey = key
+  return _cachedPrivateKey
+}
 
 function generateNonce() {
   return crypto.randomBytes(16).toString('hex')