feat: implement WeChat cross-batch refund reconciliation and fix misc issues

WeChat cross-batch refund reconciliation:
- Add OriginalAmount field to CleanedBill for accurate cumulative refund math
- DeduplicateRawFile detects WeChat status-update rows (已退款/已全额退款) and
  emits WechatRefundUpdates for Go-side reconciliation (Scenario 1)
- WechatPy cleaner surfaces -退款 income rows with no same-batch expense match
  as unresolved_refunds for Go ReconcileRefund (Scenario 2)
- Add ReconcileWechatRefund to repository interface and MongoDB implementation
- upload.go step 15 iterates WechatRefundUpdates and reconciles against bills_cleaned

Bug fixes:
- ReviewStats: add nil repo check to prevent panic when DB is not connected
- JWT: remove hardcoded fallback secret; return 500/401 if JWTSecret not configured
- Remove unused parsePageParam dead code and its strconv import
- BillDetailDrawer: show 不计收支 amount in muted gray instead of red
- test_jd_cleaner.py: replace hardcoded D:\Projects\BillAI path with dynamic __file__ resolution

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/handler/auth.go

@@ -98,7 +98,11 @@ func Login(c *gin.Context) {
 
 	secret := config.Global.JWTSecret
 	if secret == "" {
-		secret = "billai-default-secret"
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"success": false,
+			"error":   "服务器 JWT 配置缺失",
+		})
+		return
 	}
 
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
@@ -144,7 +148,12 @@ func ValidateToken(c *gin.Context) {
 
 	secret := config.Global.JWTSecret
 	if secret == "" {
-		secret = "billai-default-secret"
+		c.JSON(http.StatusUnauthorized, gin.H{
+			"success": false,
+			"error":   "服务器 JWT 配置缺失",
+			"code":    "TOKEN_INVALID",
+		})
+		return
 	}
 
 	token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {

server/handler/bills.go

@@ -2,7 +2,6 @@ package handler
 
 import (
 	"net/http"
-	"strconv"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -154,18 +153,6 @@ func ListBills(c *gin.Context) {
 	})
 }
 
-// parsePageParam 解析分页参数
-func parsePageParam(s string, defaultVal int) int {
-	if s == "" {
-		return defaultVal
-	}
-	val, err := strconv.Atoi(s)
-	if err != nil || val < 1 {
-		return defaultVal
-	}
-	return val
-}
-
 // MonthlyStatsResponse 月度统计响应
 type MonthlyStatsResponse struct {
 	Result  bool                `json:"result"`
@@ -202,6 +189,13 @@ func MonthlyStats(c *gin.Context) {
 // ReviewStats 获取待复核数据统计
 func ReviewStats(c *gin.Context) {
 	repo := repository.GetRepository()
+	if repo == nil {
+		c.JSON(http.StatusServiceUnavailable, model.ReviewResponse{
+			Result:  false,
+			Message: "数据库未连接",
+		})
+		return
+	}
 
 	// 从MongoDB查询所有需要复核的账单
 	bills, err := repo.GetBillsNeedReview()

server/handler/upload.go

@@ -269,7 +269,7 @@ func Upload(c *gin.Context) {
 		}
 	}
 
-	// 14. 核销跨批次退款（本次清洗中未在同批次内匹配到对应支出的退款）
+	// 14. 核销跨批次退款（支付宝：本次清洗中未在同批次内匹配到对应支出的退款）
 	var reconciledCount int
 	if repo != nil && cleanResult != nil {
 		for _, ur := range cleanResult.UnresolvedRefunds {
@@ -285,7 +285,26 @@ func Upload(c *gin.Context) {
 		}
 	}
 
-	// 15. 返回成功响应
+	// 15. 核销跨批次微信退款（重复上传的行中携带的已退款状态）
+	if repo != nil && len(dedupResult.WechatRefundUpdates) > 0 {
+		for _, wu := range dedupResult.WechatRefundUpdates {
+			matched, rErr := repo.ReconcileWechatRefund(wu.TransactionID, wu.FullRefund, wu.CumulativeRefundAmount)
+			if rErr != nil {
+				fmt.Printf("⚠️  微信退款核销失败: %v\n", rErr)
+				continue
+			}
+			if matched {
+				reconciledCount++
+				if wu.FullRefund {
+					fmt.Printf("💰 已核销微信全额退款: 交易单号%s\n", wu.TransactionID)
+				} else {
+					fmt.Printf("💰 已核销微信部分退款: 交易单号%s, 累计退款%.2f元\n", wu.TransactionID, wu.CumulativeRefundAmount)
+				}
+			}
+		}
+	}
+
+	// 16. 返回成功响应
 	message := fmt.Sprintf("处理成功，新增 %d 条记录", cleanedCount)
 	if dedupResult.DuplicateCount > 0 {
 		message = fmt.Sprintf("处理成功，新增 %d 条，跳过 %d 条重复记录", cleanedCount, dedupResult.DuplicateCount)