fix(payment): critical fixes from agent audit

- Fix CreateOrderResult field names (snake_case → camelCase to match backend)
- Fix MethodLimits JSON tags to consistent snake_case
- Fix Stripe webhook header case sensitivity (lowercase keys for map lookup)
- Fix MaxAmount=0 backend validation (0 = no limit, not reject all)
- Fix structured error for INVALID_AMOUNT per CLAUDE.md spec

frontend/src/types/payment.ts

@@ -120,12 +120,12 @@ export interface CreateOrderRequest {
 }
 
 export interface CreateOrderResult {
-  order_id: number
-  pay_url?: string
-  qr_code?: string
-  client_secret?: string
-  pay_amount: number
-  expires_at: string
+  orderId: number
+  payUrl?: string
+  qrCode?: string
+  clientSecret?: string
+  payAmount: number
+  expiresAt: string
 }
 
 export interface DashboardStats {

frontend/src/views/user/PaymentView.vue

@@ -230,12 +230,12 @@ async function createOrder(orderAmount: number, orderType: string, planId?: numb
       orderType: orderType,
       planId: planId,
     })
-    if (result.client_secret) {
-      router.push({ path: '/payment/stripe', query: { order_id: String(result.order_id), client_secret: result.client_secret } })
-    } else if (result.qr_code) {
-      router.push({ path: '/payment/qrcode', query: { order_id: String(result.order_id), qr: result.qr_code || '', pay_url: result.pay_url || '' } })
-    } else if (result.pay_url) {
-      window.location.href = result.pay_url
+    if (result.clientSecret) {
+      router.push({ path: '/payment/stripe', query: { order_id: String(result.orderId), client_secret: result.clientSecret } })
+    } else if (result.qrCode) {
+      router.push({ path: '/payment/qrcode', query: { order_id: String(result.orderId), qr: result.qrCode || '', pay_url: result.payUrl || '' } })
+    } else if (result.payUrl) {
+      window.location.href = result.payUrl
     } else {
       errorMessage.value = t('payment.result.failed')
       appStore.showError(errorMessage.value)