fix(v2): 超退守卫事务化 CreateRefundGuarded(锁单行+求和+插入单事务)+ sqlite DSN 补 _txlock=immediate

Task 3 计划的 RefundSum→比较→CreateRefund 两段式裸读写在并发下会超退(两个请求都读到
reserved=0、都通过、都插入)。仿 store/order.go::MarkAttemptPaid 的模式,把锁订单行
(clause.Locking FOR UPDATE,MySQL 真锁/SQLite 由 glebarez 静默丢弃)+ 求和 + 校验 + 插入
收进单个 s.db.Transaction。SQLite 侧真正的串行化靠 DSN _txlock=immediate(BEGIN IMMEDIATE
在事务开始就抢写锁)+ busy_timeout,补进 testdb.go 与 main.go 的 sqlite DSN 构造。

internal/store/refund.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 
 	"github.com/wangjia/pay/internal/model"
 )
@@ -16,6 +17,11 @@ type RefundStore struct{ db *gorm.DB }
 
 func NewRefundStore(db *gorm.DB) *RefundStore { return &RefundStore{db: db} }
 
+// CreateRefund is a plain insert with no over-refund guard — safe only for
+// callers that already hold their own serialization (e.g. tests, backfills).
+// Money-path callers (退款下单) MUST use CreateRefundGuarded instead: a bare
+// RefundSum(...)-then-CreateRefund round trip races under concurrent refund
+// requests (both read reserved=0, both pass, both insert → over-refund).
 func (s *RefundStore) CreateRefund(r *model.Refund) error {
 	if r.RefundID == "" {
 		return fmt.Errorf("store.CreateRefund: empty RefundID")
@@ -26,6 +32,58 @@ func (s *RefundStore) CreateRefund(r *model.Refund) error {
 	return nil
 }
 
+// CreateRefundGuarded 在单事务内完成 锁定订单行 → 求和(非failed)→ 超退校验 → 插入。
+// 返回 (false, nil) 表示超退拒绝;并发同单退款经订单行锁串行化。
+//
+// 订单行锁 clause.Locking{Strength: "UPDATE"} 在 MySQL 上是真正的 SELECT ... FOR
+// UPDATE 行锁;SQLite 不支持行级锁,glebarez/sqlite 的 "FOR" ClauseBuilder 会把它
+// 静默丢弃(不报错、也不生效)。SQLite 侧真正的串行化来自 DSN 的
+// _txlock=immediate(见 internal/model/testdb.go / main.go initDB):BEGIN IMMEDIATE
+// 让事务一开始就抢库级写锁,第二个并发事务的 BEGIN 会阻塞到第一个提交/回滚为止,
+// 效果等价于「锁行」。没有 _txlock=immediate 时 SQLite 默认 BEGIN DEFERRED,写锁
+// 推迟到第一次写语句才抢,两个事务的读阶段(求和)仍可能交错,防不住超退。
+func (s *RefundStore) CreateRefundGuarded(r *model.Refund, paidAmountMinor int64) (bool, error) {
+	if r.RefundID == "" {
+		return false, fmt.Errorf("store.CreateRefundGuarded: empty RefundID")
+	}
+	if r.OutTradeNo == "" {
+		return false, fmt.Errorf("store.CreateRefundGuarded: empty OutTradeNo")
+	}
+	var ok bool
+	err := s.db.Transaction(func(tx *gorm.DB) error {
+		var o model.OrderV2
+		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).
+			Where("out_trade_no = ?", r.OutTradeNo).First(&o).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return ErrOrderNotFound
+			}
+			return fmt.Errorf("lock order: %w", err)
+		}
+
+		var reserved int64
+		q := tx.Model(&model.Refund{}).
+			Where("out_trade_no = ? AND status <> ?", r.OutTradeNo, model.RefundFailed)
+		if err := q.Select("COALESCE(SUM(amount_minor),0)").Scan(&reserved).Error; err != nil {
+			return fmt.Errorf("sum refunds: %w", err)
+		}
+
+		if reserved+r.AmountMinor > paidAmountMinor {
+			ok = false
+			return nil
+		}
+
+		if err := tx.Create(r).Error; err != nil {
+			return err
+		}
+		ok = true
+		return nil
+	})
+	if err != nil {
+		return false, fmt.Errorf("store.CreateRefundGuarded: %w", err)
+	}
+	return ok, nil
+}
+
 func (s *RefundStore) GetRefund(refundID string) (*model.Refund, error) {
 	var r model.Refund
 	if err := s.db.Where("refund_id = ?", refundID).First(&r).Error; err != nil {