- Extract cancelOrderCore() shared by user cancel, admin cancel, and timeout expire - Query payment platform before cancelling: if already paid, run confirmPayment - Simplify timeout.ts to delegate to cancelOrderCore - Cancel API returns already_paid outcome for frontend handling - Show "订单已支付,无法取消" prompt with back button when cancel is blocked