feat: enhance subscription risk review workflow

src/app/api/payment/create/route.ts

@@ -6,6 +6,7 @@ import { jsonError, jsonOk } from "@/lib/api-response";
 import { getPaymentAdapter } from "@/services/payment/factory";
 import { rateLimit } from "@/lib/rate-limit";
 import { getSiteBaseUrl } from "@/services/site-url";
+import { getActiveSubscriptionRiskRestriction } from "@/services/subscription-risk-review";
 import { v4 as uuidv4 } from "uuid";
 
 const createPaymentSchema = z.object({
@@ -32,6 +33,11 @@ export async function POST(req: Request) {
       return jsonError("未登录", { status: 401 });
     }
 
+    const restriction = await getActiveSubscriptionRiskRestriction(session.user.id);
+    if (restriction) {
+      return jsonError("账户存在未处理的订阅风控限制，请先新建工单联系客服", { status: 403 });
+    }
+
     const { success, remaining } = await rateLimit(
       `ratelimit:payment:${session.user.id}`,
       5,