回调优化为单地址 upsert 配置并支持重置密钥

- 回调订阅改为单记录 upsert：保存即覆盖（URL/事件/状态），自动停用其他订阅，无新增/删除
- 新增重置密钥：保存时传 rotate_secret=true 重新生成密钥并返回一次，解决密钥丢失无法找回
- 删除不再使用的 PATCH /callbacks/:id/status 路由及对应 handler/service 死代码
- 前端回调页改为内联表单（URL/事件/状态），新增重置密钥按钮（确认后展示新密钥一次）
- 补充单地址复用、disabled 不投递、密钥轮换测试

frontend/src/api/index.ts

@@ -67,7 +67,7 @@ export const merchantApi = {
     sku: string
     buyer_reference?: string
     note?: string
-    order_status?: 'paid' | 'ship_failed'
+    order_status?: 'paid' | 'ship_failed' | 'cancelled'
   }) => request.post('/merchant/orders/test', data).then((r) => r.data.data as CreateTestOrderResult),
   getDeliveryLink: (orderNo: string) =>
     request.get(`/merchant/orders/${encodeURIComponent(orderNo)}/delivery-link`).then((r) => r.data.data as DeliveryLinkResult),
@@ -94,11 +94,9 @@ export const merchantApi = {
   deleteApiClient: (id: number) =>
     request.delete(`/merchant/api-clients/${id}`).then((r) => r.data.data),
   callbacks: () =>
-    request.get('/merchant/callbacks').then((r) => r.data.data as CallbackSubscription[]),
-  createCallback: (data: { name: string; url: string; events: string }) =>
+    request.get('/merchant/callbacks').then((r) => r.data.data as CallbackSubscription | null),
+  saveCallback: (data: { url: string; events: string; status: CallbackSubscription['status']; rotate_secret?: boolean }) =>
     request.post('/merchant/callbacks', data).then((r) => r.data.data as CallbackCredential),
-  updateCallbackStatus: (id: number, status: CallbackSubscription['status']) =>
-    request.patch(`/merchant/callbacks/${id}/status`, { status }).then((r) => r.data.data),
   members: () =>
     request.get('/merchant/members').then((r) => r.data.data as MerchantMember[]),
   addMember: (data: { user_id: number; role: MerchantMember['role']; is_default?: boolean }) =>