feat(pay): paywatch selfcheck + money-critical 验证 runbook(#34/34A)

selfcheck 子命令:用 PAY_ACCOUNT_XPUB 打印前 N 个派生收款地址,供与自己钱包/Ian Coleman
逐个核对(派生错=钱打到无私钥地址)。README 加『收真钱前必过』四步验证:①金标准测试
②Ian Coleman 独立交叉核对 ③真钱包 A selfcheck 比对 ④真链 1 USDT 收→控→测→归闭环。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pay/cmd/paywatch/main.go

@@ -16,6 +16,7 @@ package main
 
 import (
 	"context"
+	"fmt"
 	"log/slog"
 	"net/http"
 	"os"
@@ -28,6 +29,7 @@ import (
 	"github.com/wangjia/pangolin/pay/internal/pay"
 	"github.com/wangjia/pangolin/pay/internal/store"
 	"github.com/wangjia/pangolin/pay/internal/tron"
+	"github.com/wangjia/pangolin/pay/internal/wallet"
 	"github.com/wangjia/pangolin/pay/internal/watcher"
 )
 
@@ -38,7 +40,39 @@ func env(k, def string) string {
 	return def
 }
 
+// selfcheck prints the first N receiving addresses derived from PAY_ACCOUNT_XPUB.
+// MONEY-CRITICAL: compare these against your own wallet app / iancoleman.io for
+// the SAME account xpub. If they don't match, the service would hand buyers
+// addresses you cannot spend — do NOT accept any payment until they match.
+func selfcheck() {
+	xpub := os.Getenv("PAY_ACCOUNT_XPUB")
+	if xpub == "" {
+		fmt.Fprintln(os.Stderr, "PAY_ACCOUNT_XPUB is required")
+		os.Exit(1)
+	}
+	n := 5
+	if len(os.Args) > 2 {
+		if v, err := strconv.Atoi(os.Args[2]); err == nil && v > 0 {
+			n = v
+		}
+	}
+	fmt.Println("Derived receiving addresses (compare against your wallet for this xpub):")
+	for i := 0; i < n; i++ {
+		addr, err := wallet.AddressFromAccountXpub(xpub, 0, uint32(i))
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "derive %d: %v\n", i, err)
+			os.Exit(1)
+		}
+		fmt.Printf("  m/44'/195'/0'/0/%d  ->  %s\n", i, addr)
+	}
+}
+
 func main() {
+	if len(os.Args) > 1 && os.Args[1] == "selfcheck" {
+		selfcheck()
+		return
+	}
+
 	log := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
 	xpub := os.Getenv("PAY_ACCOUNT_XPUB")