fix: 5 critical payment issues from code review

1. Move notify route before authMiddleware (WeChat callback has no JWT)
2. Add await to verifyNotifySignature call (was fire-and-forget)
3. Remove dangerous verify fallback — all signature failures now throw
4. Payment sync polls 3x before giving up, never redirects to success
   page unless confirmed paid
5. Production guard enforces all WX_MCH_* env vars on startup

server/src/app.js

@@ -47,6 +47,9 @@ app.use('/api/v1/admin/login', adminLoginLimiter)
 app.use('/api/v1/user/avatar', uploadLimiter)
 app.use('/api/v1/user/phone', uploadLimiter)
 
+// WeChat Pay callback — must be before authMiddleware (no JWT)
+app.post('/api/v1/payment/wechat/notify', require('./routes/payment-notify'))
+
 app.use(authMiddleware)
 
 app.get('/health', (req, res) => res.json(ok({ status: 'ok' })))
@@ -59,7 +62,6 @@ app.use('/api/v1', require('./routes/treatment'))
 app.use('/api/v1/admin', require('./routes/admin'))
 app.use('/api/v1', require('./routes/firmware'))
 app.use('/api/v1', require('./routes/payment'))
-app.post('/api/v1/payment/wechat/notify', require('./routes/payment-notify'))
 
 app.use((req, res) => res.status(404).json(fail(404, 'not_found')))