feat: harden phase 3 api security

apps/api/serializers.py

@@ -1,5 +1,6 @@
 from decimal import Decimal
 
+from django.conf import settings
 from rest_framework import serializers
 
 from apps.billing.models import RechargeOrder
@@ -57,6 +58,12 @@ class RechargeCreateRequestSerializer(serializers.Serializer):
     )
     pay_method = serializers.ChoiceField(choices=RechargeOrder.PayMethod.values)
 
+    def validate_amount(self, value):
+        max_amount = Decimal(str(settings.RECHARGE_MAX_AMOUNT_CNY))
+        if value > max_amount:
+            raise serializers.ValidationError(f"单笔充值金额不能超过 {max_amount:.2f} CNY")
+        return value
+
 
 class RechargeStatusRequestSerializer(serializers.Serializer):
     order_no = serializers.CharField(