fix(backend): PaymentService 微信支付V3解密用原始API密钥而非SHA-256哈希

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

cfc-backend/src/main/java/com/etotem/cfc/service/PaymentService.java

@@ -28,7 +28,6 @@ import javax.crypto.spec.SecretKeySpec;
 import java.io.*;
 import java.nio.charset.StandardCharsets;
 import java.security.KeyFactory;
-import java.security.MessageDigest;
 import java.security.PrivateKey;
 import java.security.Signature;
 import java.security.spec.PKCS8EncodedKeySpec;
@@ -508,10 +507,13 @@ public class PaymentService implements PaymentServiceInterface {
             log.warn("API V3密钥未配置，使用模拟解密");
             return "{\"out_trade_no\":\"mock\",\"transaction_id\":\"mock\",\"trade_state\":\"SUCCESS\"}";
         }
-        MessageDigest md = MessageDigest.getInstance("SHA-256");
-        byte[] apiKeyHash = md.digest(apiV3Key.getBytes(StandardCharsets.UTF_8));
+        // Per WeChat Pay v3 spec: use the APIv3 key directly as AES-256 key (exactly 32 bytes)
+        byte[] aesKey = apiV3Key.getBytes(StandardCharsets.UTF_8);
+        if (aesKey.length != 32) {
+            log.warn("API V3密钥长度不为32字节，实际长度={}", aesKey.length);
+        }
 
-        SecretKeySpec keySpec = new SecretKeySpec(apiKeyHash, "AES");
+        SecretKeySpec keySpec = new SecretKeySpec(aesKey, "AES");
         GCMParameterSpec gcmSpec = new GCMParameterSpec(128, Base64.getDecoder().decode(nonce));
 
         Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");