feat: harden CMPP delivery and platform workflows

api/src/tenants/tenants.service.spec.ts

@@ -1,4 +1,4 @@
-import { NotFoundException } from '@nestjs/common';
+import { BadRequestException, NotFoundException } from '@nestjs/common';
 import { TenantsService } from './tenants.service';
 
 function createPrismaMock() {
@@ -81,6 +81,14 @@ describe('TenantsService', () => {
     expect(prisma.tenant.update).not.toHaveBeenCalled();
   });
 
+  it('rejects enterprise credit codes containing non-alphanumeric characters', async () => {
+    const prisma = createPrismaMock();
+    const service = new TenantsService(prisma as never);
+
+    await expect(service.create({ name: '测试企业', creditCode: '9137-中文' })).rejects.toBeInstanceOf(BadRequestException);
+    expect(prisma.tenant.create).not.toHaveBeenCalled();
+  });
+
   it('lists management rows with real account, today spend and actual refund fields', async () => {
     const prisma = createPrismaMock();
     const service = new TenantsService(prisma as never);