feat: Enhance service management and transaction handling

- Implemented client access token verification middleware to secure API endpoints.
- Updated ServiceController to fetch active hosting services for authenticated users.
- Refactored OrderController to ensure order retrieval is customer-specific.
- Improved error logging in VmController for unexpected vCenter responses.
- Disabled VNPay auto-deposit in TransactionController, switching to manual deposit flow.
- Enhanced ServiceClientDetailResource to include Plesk credentials for hosting accounts.
- Adjusted VpsServiceResource to dynamically set page type based on product type.
- Added logging for PowerShellService to capture errors in RDP port changes.
- Provisioning job now resolves service plans and logs relevant information for hosting accounts.
- Updated database migrations to add necessary fields for service plans and DNS servers.
- Refactored Service and ServicePlan models to establish relationships with hosting accounts and DNS servers.

app/Http/Middleware/ClientAccessTokenCheck.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class ClientAccessTokenCheck
+{
+    /**
+     * Verify the `x-access-token` header contains an AES-256-CBC ciphertext
+     * (base64(iv . ciphertext)) of the shared secret, encrypted with the
+     * openssl key configured in services.client_api.key. Blocks callers
+     * that don't hold the shared key (external scraping/direct API calls).
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        $token = $request->header('x-access-token', '');
+        $key = config('services.client_api.key');
+
+        if (!$key || !$this->isValid($token, $key)) {
+            return response()->json([
+                'error' => true,
+                'message' => 'Invalid access token',
+                'code' => 403,
+            ], 403);
+        }
+
+        return $next($request);
+    }
+
+    private function isValid(string $token, string $key): bool
+    {
+        $raw = base64_decode($token, true);
+        if ($raw === false || strlen($raw) <= 16) {
+            return false;
+        }
+
+        $iv = substr($raw, 0, 16);
+        $ciphertext = substr($raw, 16);
+
+        $plaintext = openssl_decrypt($ciphertext, 'aes-256-cbc', hex2bin($key), OPENSSL_RAW_DATA, $iv);
+
+        if ($plaintext === false) {
+            return false;
+        }
+
+        return hash_equals(config('services.client_api.secret'), $plaintext);
+    }
+}