fix: 充值订单列表按当前登录资产过滤，修复越权查看其他资产数据的漏洞

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

internal/store/postgres/recharge_order_store.go

@@ -131,14 +131,16 @@ func (s *RechargeOrderStore) ListByUserID(ctx context.Context, userID uint, offs
 }
 
 type ListRechargeOrderParams struct {
-	Page      int
-	PageSize  int
-	UserID    *uint
-	IotCardID *uint
-	DeviceID  *uint
-	Status    *int
-	StartTime interface{}
-	EndTime   interface{}
+	Page         int
+	PageSize     int
+	UserID       *uint
+	IotCardID    *uint
+	DeviceID     *uint
+	Status       *int
+	StartTime    interface{}
+	EndTime      interface{}
+	ResourceType *string
+	ResourceID   *uint
 }
 
 func (s *RechargeOrderStore) List(ctx context.Context, params *ListRechargeOrderParams) ([]*model.RechargeOrder, int64, error) {
@@ -159,6 +161,9 @@ func (s *RechargeOrderStore) List(ctx context.Context, params *ListRechargeOrder
 	if params.Status != nil {
 		query = query.Where("status = ?", *params.Status)
 	}
+	if params.ResourceType != nil && params.ResourceID != nil {
+		query = query.Where("resource_type = ? AND resource_id = ?", *params.ResourceType, *params.ResourceID)
+	}
 	if params.StartTime != nil {
 		query = query.Where("created_at >= ?", params.StartTime)
 	}