fix(lastleg): restore dispatch returns from immutable pick source and expose customer receipts

lastleg-service/src/main/java/com/baiyue/lastleg/delivery/controller/MerchantDeliveryController.java

@@ -5,20 +5,24 @@ import com.baiyue.common.core.api.PageResult;
 import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.lastleg.delivery.dto.DeliveryRequests;
 import com.baiyue.lastleg.delivery.dto.DeliveryResponses;
+import com.baiyue.lastleg.delivery.dto.DeliveryDocumentDtos;
+import com.baiyue.lastleg.delivery.service.DeliveryDocumentService;
 import com.baiyue.lastleg.delivery.service.DeliveryTransferService;
 import com.baiyue.lastleg.security.OverseasPermissions;
 import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
-import org.springframework.http.HttpStatus;
+import org.springframework.http.*;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.server.ResponseStatusException;
+import java.nio.charset.StandardCharsets;
 
 @RestController
 @RequestMapping("/api/merchant/v1/last-leg/delivery-orders")
 public class MerchantDeliveryController {
     @Resource private DeliveryTransferService service;
+    @Resource private DeliveryDocumentService documents;
 
     @GetMapping
     @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DELIVERY_LIST + "')")
@@ -42,9 +46,29 @@ public class MerchantDeliveryController {
         return ApiResponse.success(service.deliveryDetail(customer(user), deliveryNo));
     }
 
+    @GetMapping("/{deliveryNo}/documents/receipt")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DELIVERY_LIST + "')")
+    public ApiResponse<DeliveryDocumentDtos.MerchantReceipts> receipts(
+        @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String deliveryNo) {
+        return ApiResponse.success(documents.merchantReceipts(customer(user), deliveryNo));
+    }
+
+    @GetMapping("/{deliveryNo}/documents/receipt/files/{fileId}/download")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DELIVERY_LIST + "')")
+    public ResponseEntity<byte[]> receiptDownload(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String deliveryNo, @PathVariable long fileId) {
+        DeliveryDocumentService.Download downloaded = documents.merchantReceiptDownload(customer(user), deliveryNo, fileId);
+        return ResponseEntity.ok().cacheControl(CacheControl.noStore())
+            .contentType(MediaType.APPLICATION_OCTET_STREAM)
+            .header("X-Content-Type-Options", "nosniff")
+            .header(HttpHeaders.CONTENT_DISPOSITION, ContentDisposition.attachment()
+                .filename(downloaded.file().fileName(), StandardCharsets.UTF_8).build().toString())
+            .body(downloaded.content());
+    }
+
     private String customer(AuthenticatedUser user) {
         if (user == null || user.tenantId() == null) throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
-        if ("PLATFORM".equals(user.appCode()) || user.tenantId() == 0L) throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Merchant identity is required");
+        if (!"MERCHANT".equals(user.appCode()) || user.tenantId() <= 0L) throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Merchant identity is required");
         return String.valueOf(user.tenantId());
     }
     private String operator(AuthenticatedUser user) { return user.userId() == null ? user.username() : String.valueOf(user.userId()); }

lastleg-service/src/main/java/com/baiyue/lastleg/delivery/dto/DeliveryDocumentDtos.java

@@ -16,6 +16,7 @@ public final class DeliveryDocumentDtos {
                           @NotNull @Size(max=20) List<@NotNull @Min(1) Long> fileIds) { }
     public record File(Long fileId, String fileName, String contentType, long sizeBytes,
                        LocalDateTime uploadedAt) { }
+    public record MerchantReceipts(String deliveryNo, List<File> files) { }
     public record Category(DeliveryDocumentCategory category, String status, int fileCount, List<File> files) { }
     public record CategorySummary(DeliveryDocumentCategory category, String status, int fileCount) { }
     public record Summary(int uploadedCategoryCount, int totalCategoryCount, List<CategorySummary> categories) { }

lastleg-service/src/main/java/com/baiyue/lastleg/delivery/service/DeliveryDocumentService.java

@@ -37,6 +37,17 @@ public class DeliveryDocumentService {
 
     public Detail detail(String customerId, String deliveryNo) { return detail(require(customerId, deliveryNo), false); }
 
+    public MerchantReceipts merchantReceipts(String customerId, String deliveryNo) {
+        Detail snapshot = detail(customerId, deliveryNo);
+        return new MerchantReceipts(snapshot.deliveryNo(), snapshot.categories().stream()
+            .filter(category -> category.category() == DeliveryDocumentCategory.RECEIPT)
+            .flatMap(category -> category.files().stream()).toList());
+    }
+
+    public Download merchantReceiptDownload(String customerId, String deliveryNo, long fileId) {
+        return download(customerId, deliveryNo, DeliveryDocumentCategory.RECEIPT, fileId, null);
+    }
+
     public DeliveryDocumentDtos.File upload(String customerId, String deliveryNo, DeliveryDocumentCategory category,
                                             String operatorId, MultipartFile file) {
         DeliveryOrder order = require(customerId, deliveryNo);