Fix duplicate session billing and align pricing with DeepSeek ×3.

Serialize billSessionUsage with row locks, expose rates on recharge, add compensation script and admin usage views.

Co-authored-by: Cursor <cursoragent@cursor.com>

server.mjs

@@ -804,9 +804,16 @@ adminApi.post('/users/:userId/recharge', requireAdmin, async (req, res) => {
   res.json({ user: result.user });
 });
 
+adminApi.get('/usage/summary', requireAdmin, async (req, res) => {
+  const userId = typeof req.query.userId === 'string' ? req.query.userId : null;
+  const summary = await userAuth.getUsageSummary({ userId });
+  if (userId && !summary) return res.status(404).json({ message: '用户不存在' });
+  res.json({ summary });
+});
+
 adminApi.get('/usage', requireAdmin, async (req, res) => {
   const userId = typeof req.query.userId === 'string' ? req.query.userId : null;
-  const limit = Number(req.query.limit ?? 50);
+  const limit = Number(req.query.limit ?? 20);
   const records = await userAuth.listUsageRecords({ userId, limit });
   res.json({ records });
 });
@@ -1055,12 +1062,22 @@ adminApi.post('/plaza/posts/:id/review', requireAdmin, async (req, res) => {
   }
 });
 
+app.get('/auth/usage/summary', async (req, res) => {
+  await userAuthReady;
+  if (!userAuth) return res.status(503).json({ message: '未启用用户系统' });
+  const me = await userAuth.getMe(userToken(req));
+  if (!me) return res.status(401).json({ message: '未登录' });
+  const summary = await userAuth.getUsageSummary({ userId: me.id });
+  res.json({ summary });
+});
+
 app.get('/auth/usage', async (req, res) => {
   await userAuthReady;
   if (!userAuth) return res.status(503).json({ message: '未启用用户系统' });
   const me = await userAuth.getMe(userToken(req));
   if (!me) return res.status(401).json({ message: '未登录' });
-  const records = await userAuth.listUsageRecords({ userId: me.id, limit: 30 });
+  const limit = Number(req.query.limit ?? 20);
+  const records = await userAuth.listUsageRecords({ userId: me.id, limit });
   res.json({ records });
 });