fix: expose payment admin navigation

docs/BUG_HISTORY.md

@@ -1610,4 +1610,19 @@
 - 防复发：活动运行配置和测试不得重新引入独立后台域名、`AUTH_ADMIN_ORIGIN`、`BETTER_AUTH_ADMIN_SECRET` 或浏览器 admin auth service；`viewer` 对后台入口、页面、读 API 和写 API 均必须为 `403`；入口可见性不能替代 route guard。
 - 相关记录：BUG-010、BUG-083、BUG-084、BUG-087
 - 复发自：BUG-087
-- 修复版本：本地实现，待 staging 验收
+- 修复版本：`435e628806390e7ae138363491e7bae63ee801d4`，staging 已验收
+
+## BUG-093 | 后台导航遗漏支付记录与支付配置入口
+
+- 状态：resolved
+- 首次发现：2026-07-29
+- 最近更新：2026-07-29
+- 影响面：后台 Refine 侧栏导航；支付页面与后台支付 API 本身不受影响。
+- 用户现象：管理员进入后台后只能看到兑换码、用户、积分流水、咨询和审计菜单，看不到支付记录与支付配置。
+- 触发条件：进入同域 `/admin` 后通过 Refine `resources` 生成后台导航。
+- 根因：`/admin/payments`、`/admin/packages` 页面及 `/api/admin/payments`、`/api/admin/packages` 接口已经存在，但 `AdminApp` 的 `resources` 数组没有注册这两个资源。
+- 修复：在后台导航中增加“支付记录”和“支付配置”，分别指向 `/admin/payments` 与 `/admin/packages`，并使用支付卡和设置图标；权限仍由统一的 admin-only 页面/API guard 执行。
+- 验证：后台合同测试锁定两个资源的名称、路径与图标；Next.js 生产构建通过；staging 部署和登录态验收记录在本次交付报告。
+- 防复发：新增独立后台页面时必须同步注册导航资源，后台合同测试必须覆盖页面路由与菜单资源的一致性。
+- 相关记录：BUG-087、BUG-092
+- 修复版本：待 staging 验收

frontend/src/components/admin/admin-app.tsx

@@ -2,8 +2,10 @@
 
 import {
   AuditOutlined,
+  CreditCardOutlined,
   GiftOutlined,
   MessageOutlined,
+  SettingOutlined,
   TeamOutlined,
   TransactionOutlined,
 } from "@ant-design/icons";
@@ -32,6 +34,8 @@ export function AdminApp({ children }: { children: ReactNode }) {
           notificationProvider={notificationProvider}
           resources={[
             { name: "codes", list: "/admin/codes", meta: { label: "兑换码", icon: <GiftOutlined /> } },
+            { name: "payments", list: "/admin/payments", meta: { label: "支付记录", icon: <CreditCardOutlined /> } },
+            { name: "packages", list: "/admin/packages", meta: { label: "支付配置", icon: <SettingOutlined /> } },
             { name: "users", list: "/admin/codes?resource=users", meta: { label: "用户资料", icon: <TeamOutlined /> } },
             { name: "credit-transactions", list: "/admin/codes?resource=credit-transactions", meta: { label: "积分流水", icon: <TransactionOutlined /> } },
             { name: "consultations", list: "/admin/codes?resource=consultations", meta: { label: "咨询请求", icon: <MessageOutlined /> } },

frontend/tests/admin-contracts.test.ts

@@ -13,6 +13,7 @@ const codesRoute = readFileSync(new URL("../src/app/api/admin/codes/route.ts", i
 const codeRoute = readFileSync(new URL("../src/app/api/admin/codes/[id]/route.ts", import.meta.url), "utf8");
 const providers = readFileSync(new URL("../src/lib/admin/providers.ts", import.meta.url), "utf8");
 const adminLayout = readFileSync(new URL("../src/app/admin/layout.tsx", import.meta.url), "utf8");
+const adminApp = readFileSync(new URL("../src/components/admin/admin-app.tsx", import.meta.url), "utf8");
 const adminRootRoute = readFileSync(new URL("../src/app/admin/route.ts", import.meta.url), "utf8");
 const readonlyRoutes = ["users", "credit-transactions", "consultations", "audit-logs"].map((resource) =>
   readFileSync(new URL(`../src/app/api/admin/${resource}/route.ts`, import.meta.url), "utf8"),
@@ -43,6 +44,13 @@ test("self-hosted account entry checks only the persisted admin role", () => {
   assert.match(auth, /authorizeAdminAccess\(user, access\)/);
 });
 
+test("admin navigation exposes payment records and payment configuration", () => {
+  assert.match(adminApp, /name: "payments", list: "\/admin\/payments", meta: \{ label: "支付记录"/);
+  assert.match(adminApp, /name: "packages", list: "\/admin\/packages", meta: \{ label: "支付配置"/);
+  assert.match(adminApp, /CreditCardOutlined/);
+  assert.match(adminApp, /SettingOutlined/);
+});
+
 test("admin pages and root route are server-gated before rendering or redirecting", () => {
   assert.match(adminLayout, /await requireAdminSession\("read"\)/);
   assert.match(adminLayout, /error\.status === 401 \? "\/login" : "\/"/);