fix(billing): resolve all audit findings — CSRF, float precision, TOCTOU, error sanitization

- Add CSRF token protection for mock payment (SHA256 + constant-time verify)
- Replace f64 currency conversion with pure integer string parsing (parse_yuan_to_cents)
- Move subscription check inside transaction to prevent TOCTOU race
- Rewrite increment_usage to use atomic SQL (account_id+period_start WHERE)
- Add trade_no format validation in payment callback
- Sanitize error messages to prevent sensitive data leakage
- Use i32::try_from for WeChat amount conversion (prevent truncation)
- Replace window.__ZCLAW_STATS_SYNC_INTERVAL__ with useRef pattern
- Replace eprintln/println with tracing macros in lifecycle
- Remove unused variable in scheduler
- Remove duplicate sha2 and unused hmac from Cargo.toml

crates/zclaw-saas/Cargo.toml

@@ -29,7 +29,6 @@ sqlx = { workspace = true }
 pgvector = { version = "0.4", features = ["sqlx"] }
 reqwest = { workspace = true }
 secrecy = { workspace = true }
-sha2 = { workspace = true }
 rand = { workspace = true }
 dashmap = { workspace = true }
 hex = { workspace = true }
@@ -49,6 +48,7 @@ urlencoding = "2"
 data-encoding = "2"
 regex = { workspace = true }
 aes-gcm = { workspace = true }
+sha2 = { workspace = true }
 bytes = { workspace = true }
 async-stream = { workspace = true }