Guoguo
731122064b
1. Move notify route before authMiddleware (WeChat callback has no JWT) 2. Add await to verifyNotifySignature call (was fire-and-forget) 3. Remove dangerous verify fallback — all signature failures now throw 4. Payment sync polls 3x before giving up, never redirects to success page unless confirmed paid 5. Production guard enforces all WX_MCH_* env vars on startup