fix: review 修复——meta 覆盖、重复支付、卸载守卫、测试补全

- EditPost 保存时合并表单中的部分 meta 键，防止插件注入字段覆盖 unlocked_user_ids 等其他键（单篇解锁用户会失去权限的 bug）
- unlockPost：已有阅读权限（会员/作者/已解锁）直接跳文章，不重复支付
- subscribe：已有该套餐有效订阅直接跳我的订阅页
- uninstall：存在已启用的依赖者时拒绝卸载（与 disable 一致）
- .gitignore 排除 storage/media-library/temp 测试残留
- 测试：AdminPagesTest 补 /admin/plugins /admin/payments；新增 Livewire 保存验证 meta 保留、解锁/订阅防重复支付、卸载守卫

tests/Feature/AdminPagesTest.php

@@ -50,6 +50,12 @@ class AdminPagesTest extends TestCase
         $this->actingAs($this->admin)->get('/admin/media')->assertOk();
     }
 
+    public function test_plugin_and_payment_pages_load(): void
+    {
+        $this->actingAs($this->admin)->get('/admin/plugins')->assertOk();
+        $this->actingAs($this->admin)->get('/admin/payments')->assertOk();
+    }
+
     public function test_guest_is_redirected_to_login(): void
     {
         $this->get('/admin')->assertRedirect('/admin/login');

tests/Feature/MembershipFlowTest.php

@@ -112,7 +112,8 @@ class MembershipFlowTest extends TestCase
             'content_format' => 'markdown',
             'status' => 'published',
             'published_at' => now(),
-            'meta' => ['price' => 500],
+            // members_only：非会员被拦截，可单篇支付解锁
+            'meta' => ['price' => 500, 'members_only' => true],
         ]);
 
         $this->actingAs($this->user)
@@ -147,4 +148,40 @@ class MembershipFlowTest extends TestCase
         $this->assertSame('—', $payment->payable_label);
         $this->assertNull($payment->payable_url);
     }
+
+    public function test_unlock_post_skips_payment_when_already_unlocked(): void
+    {
+        $post = Post::create([
+            'title' => '已解锁',
+            'slug' => 'already-unlocked',
+            'content' => '内容',
+            'content_format' => 'markdown',
+            'status' => 'published',
+            'published_at' => now(),
+            'meta' => ['price' => 500, 'unlocked_user_ids' => [$this->user->id]],
+        ]);
+
+        $this->actingAs($this->user)
+            ->post('/posts/'.$post->id.'/unlock')
+            ->assertRedirect('/posts/already-unlocked.shtml');
+
+        $this->assertSame(0, Payment::query()->count());
+    }
+
+    public function test_subscribe_skips_payment_when_plan_already_active(): void
+    {
+        Subscription::create([
+            'user_id' => $this->user->id,
+            'membership_plan_id' => $this->plan->id,
+            'status' => 'active',
+            'starts_at' => now(),
+            'ends_at' => now()->addDays(30),
+        ]);
+
+        $this->actingAs($this->user)
+            ->post('/membership/'.$this->plan->id.'/subscribe')
+            ->assertRedirect(route('membership.mine'));
+
+        $this->assertSame(0, Payment::query()->count());
+    }
 }

tests/Feature/PluginDependencyTest.php

@@ -83,6 +83,21 @@ class PluginDependencyTest extends TestCase
         $this->assertSame(['neatstudio.payment'], $plugins['neatstudio.membership']['dependency_errors']);
     }
 
+    public function test_uninstall_plugin_with_enabled_dependent_throws(): void
+    {
+        $manager = $this->manager();
+
+        try {
+            $manager->uninstall('neatstudio.payment');
+            $this->fail('存在已启用的依赖者时应抛出异常');
+        } catch (RuntimeException $e) {
+            $this->assertStringContainsString('neatstudio.membership', $e->getMessage());
+        }
+
+        // 卸载失败，记录仍在
+        $this->assertTrue($manager->isEnabled('neatstudio.payment'));
+    }
+
     public function test_dependency_problems_for_missing_plugin(): void
     {
         $manager = $this->manager();

tests/Feature/PostFormInjectionTest.php

@@ -4,10 +4,13 @@ declare(strict_types=1);
 
 namespace Tests\Feature;
 
+use App\Filament\Resources\Posts\Pages\EditPost;
 use App\Filament\Resources\Posts\PostResource;
+use App\Models\Post;
 use Filament\Schemas\Schema;
 use Filament\Tables\Table;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
 use ReflectionClass;
 use Tests\TestCase;
 
@@ -55,7 +58,7 @@ class PostFormInjectionTest extends TestCase
 
     public function test_meta_price_maps_to_post_meta_json(): void
     {
-        $post = \App\Models\Post::create([
+        $post = Post::create([
             'title' => '付费文章',
             'content' => '内容',
             'content_format' => 'markdown',
@@ -67,4 +70,27 @@ class PostFormInjectionTest extends TestCase
         $this->assertSame(9900, $post->meta['price']);
         $this->assertTrue($post->meta['members_only']);
     }
+
+    public function test_edit_post_save_preserves_other_meta_keys(): void
+    {
+        $post = Post::create([
+            'title' => '已解锁文章',
+            'slug' => 'unlocked-post',
+            'content' => '内容',
+            'content_format' => 'markdown',
+            'status' => 'published',
+            'published_at' => now(),
+            'meta' => ['price' => 9900, 'members_only' => true, 'unlocked_user_ids' => [1, 2]],
+        ]);
+
+        Livewire::test(EditPost::class, ['record' => $post->getRouteKey()])
+            ->call('save')
+            ->assertHasNoFormErrors();
+
+        $post->refresh();
+        // 表单只含 price/members_only，保存时不得覆盖解锁用户等其他 meta 键
+        $this->assertSame([1, 2], $post->meta['unlocked_user_ids']);
+        $this->assertSame(9900, $post->meta['price']);
+        $this->assertTrue($post->meta['members_only']);
+    }
 }