fix(fin): 激活配置并发行锁保护 FIN-03

- commission_withdrawal_setting/service.go: 激活事务内首步加 FOR UPDATE 行锁，防止并发时出现多条 is_active=true
- wechat_config_store.go: ActivateInTx 激活前同样加行锁保护

internal/service/commission_withdrawal_setting/service.go

@@ -11,6 +11,7 @@ import (
 	"github.com/break/junhong_cmp_fiber/pkg/errors"
 	"github.com/break/junhong_cmp_fiber/pkg/middleware"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 )
 
 type Service struct {
@@ -47,6 +48,12 @@ func (s *Service) Create(ctx context.Context, req *dto.CreateWithdrawalSettingRe
 	setting.Updater = currentUserID
 
 	err := s.db.Transaction(func(tx *gorm.DB) error {
+		// 先锁定当前活跃记录，防止并发激活导致多条 is_active=true
+		var current model.CommissionWithdrawalSetting
+		tx.WithContext(ctx).Clauses(clause.Locking{Strength: "UPDATE"}).
+			Where("is_active = ?", true).
+			First(&current)
+
 		if err := s.commissionWithdrawalSettingStore.DeactivateCurrentWithTx(ctx, tx); err != nil {
 			return errors.Wrap(errors.CodeInternalError, err, "失效旧配置失败")
 		}