feat(billing): 完成异步结算与请求执行闭环

统一任务成功、Attempt 与结算 Outbox 的事务边界，增加多实例安全结算、人工复核、请求幂等与执行租约。钱包决策使用九位精确金额，并通过审计保护约束保留流水事实；同时补充管理接口、指标与 PostgreSQL 集成测试。

apps/api/internal/runner/queue_worker.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/auth"
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/store"
+	"github.com/google/uuid"
 	"github.com/riverqueue/river"
 	"github.com/riverqueue/river/riverdriver/riverpgxv5"
 	"github.com/riverqueue/river/rivermigrate"
@@ -38,16 +39,22 @@ func (w *asyncTaskWorker) Work(ctx context.Context, job *river.Job[asyncTaskArgs
 	if task.Status == "succeeded" || task.Status == "failed" || task.Status == "cancelled" {
 		return nil
 	}
-	result, runErr := w.service.Execute(ctx, task, authUserFromTask(task))
+	executionToken := uuid.NewString()
+	result, runErr := w.service.executeWithToken(ctx, task, authUserFromTask(task), nil, executionToken)
 	if runErr == nil {
 		w.service.logger.Debug("river async task completed", "taskID", task.ID, "status", result.Task.Status, "riverJobID", job.ID)
 		return nil
 	}
+	if errors.Is(runErr, store.ErrTaskExecutionLeaseUnavailable) {
+		w.service.logger.Debug("river async task execution lease already held", "taskID", task.ID, "riverJobID", job.ID)
+		return nil
+	}
 	var queuedErr *TaskQueuedError
 	if errors.As(runErr, &queuedErr) {
 		return river.JobSnooze(queuedErr.Delay)
 	}
 	if ctx.Err() != nil {
+		task.ExecutionToken = executionToken
 		queued, queueErr := w.service.requeueInterruptedAsyncTask(context.WithoutCancel(ctx), task)
 		if queueErr != nil {
 			return queueErr
@@ -145,8 +152,7 @@ func (s *Service) recoverAsyncRiverJobs(ctx context.Context) error {
 		return err
 	}
 	for _, item := range items {
-		task := store.GatewayTask{ID: item.ID}
-		result, err := s.riverClient.Insert(ctx, asyncTaskArgs{TaskID: item.ID}, asyncTaskInsertOpts(task))
+		result, err := s.riverClient.Insert(ctx, asyncTaskArgs{TaskID: item.ID}, asyncTaskRecoveryInsertOpts(item))
 		if err != nil {
 			return err
 		}
@@ -186,6 +192,16 @@ func asyncTaskInsertOpts(task store.GatewayTask) *river.InsertOpts {
 	}
 }
 
+func asyncTaskRecoveryInsertOpts(item store.AsyncTaskQueueItem) *river.InsertOpts {
+	opts := asyncTaskInsertOpts(store.GatewayTask{ID: item.ID})
+	opts.ScheduledAt = item.NextRunAt
+	// A replacement process must not be blocked by a River row that the dead
+	// process left in running state. PostgreSQL execution leases still ensure
+	// that only one recovery job can call the upstream provider.
+	opts.UniqueOpts = river.UniqueOpts{}
+	return opts
+}
+
 func authUserFromTask(task store.GatewayTask) *auth.User {
 	roles := []string{"user"}
 	if strings.TrimSpace(task.UserID) == "" {