fix: 下游预报凭证快照整套同源，避免与订单字段混拼

Co-authored-by: Cursor <cursoragent@cursor.com>

src/Oms.Application/Shared/OrderDownstreamCredentialResolver.cs

@@ -17,7 +17,9 @@ public sealed class OrderDownstreamCredentials
 }
 
 /// <summary>
-/// 解析订单下游 itfx 凭证（优先订单绑定字段，回退渠道分组）。
+/// 解析订单下游 itfx 凭证。
+/// 优先级：服务渠道规则快照（整套同源）→ 订单绑定字段 → 渠道分组实时查询。
+/// 快照命中时 SupplierCode/AppKey/AppSecret 必须同出快照，禁止与订单字段混拼。
 /// </summary>
 public class OrderDownstreamCredentialResolver(
     IServiceChannelRepository serviceChannelRepository,
@@ -213,23 +215,20 @@ public class OrderDownstreamCredentialResolver(
             return null;
         }
 
+        // 整套同源：禁止用订单 SupplierCode/AppKey 拼快照 AppSecret，避免两边发布不同步时混用。
         var appSecret = downstream.AppSecret?.Trim();
         if (string.IsNullOrWhiteSpace(appSecret))
         {
             return null;
         }
 
-        var appKey = !string.IsNullOrWhiteSpace(order.DownstreamAppKey)
+        var appKey = downstream.AppKey?.Trim();
-            ? order.DownstreamAppKey.Trim()
-            : downstream.AppKey?.Trim();
         if (string.IsNullOrWhiteSpace(appKey))
         {
             return null;
         }
 
-        var supplierCode = !string.IsNullOrWhiteSpace(order.DownstreamSupplierCode)
+        var supplierCode = downstream.SupplierCode?.Trim();
-            ? order.DownstreamSupplierCode.Trim()
-            : downstream.SupplierCode?.Trim();
         if (string.IsNullOrWhiteSpace(supplierCode))
         {
             return null;