fix: 消除 buildOrderStatusUrl 重复定义，修复轮询回调引用稳定性

- 将 buildOrderStatusUrl 提取到 status-url.ts（客户端安全模块），
  删除 OrderStatus/PaymentQRCode/result 三处重复定义
- OrderStatus.tsx 轮询 effect 使用 useRef 保存 onStateChange，
  避免非 memoized 回调导致定时器不断重建
- result/page.tsx 增加 accessToken 最小长度校验，
  避免无效参数触发无意义的 API 请求

src/app/pay/result/page.tsx

@@ -5,6 +5,7 @@ import { useSearchParams } from 'next/navigation';
 import { useEffect, useState, Suspense } from 'react';
 import { applyLocaleToSearchParams, pickLocaleText, resolveLocale, type Locale } from '@/lib/locale';
 import type { PublicOrderStatusSnapshot } from '@/lib/order/status';
+import { buildOrderStatusUrl } from '@/lib/order/status-url';
 
 type WindowWithAlipayBridge = Window & {
   AlipayJSBridge?: {
@@ -54,15 +55,6 @@ function closeCurrentWindow() {
   }, 250);
 }
 
-function buildOrderStatusUrl(orderId: string, accessToken?: string | null): string {
-  const query = new URLSearchParams();
-  if (accessToken) {
-    query.set('access_token', accessToken);
-  }
-  const suffix = query.toString();
-  return suffix ? `/api/orders/${orderId}?${suffix}` : `/api/orders/${orderId}`;
-}
-
 function getStatusConfig(order: PublicOrderStatusSnapshot | null, locale: Locale, hasAccessToken: boolean) {
   if (!order) {
     return locale === 'en'
@@ -142,7 +134,7 @@ function ResultContent() {
   }, [isPopup]);
 
   useEffect(() => {
-    if (!outTradeNo || !accessToken) {
+    if (!outTradeNo || !accessToken || accessToken.length < 10) {
       setLoading(false);
       return;
     }