fix: improve h5 payment return flow

.claude/skills/project-management/SKILL.md

@@ -11,6 +11,8 @@ Use the outer repository as the single source of truth for all project work. Do
 
 Do not manage release artifacts in Git. Files under `releases/` and `releases_dev/`, including zip packages, APKs, and checksum files, are local delivery artifacts and must not be committed or pushed. Put production packages in `releases/` and test packages in `releases_dev/`.
 
+Local development and the test server share the test database connection. Store the real host, username, and password only in ignored `.env` files or server environment variables. The shared test database name is `test_anxinyan`; never commit real database passwords to docs, skills, examples, or Git-tracked templates.
+
 ## Branch Model
 
 - `master`: stable, release-ready mainline. Do not do daily development directly here.
@@ -52,15 +54,42 @@ Before committing, run:
 ```bash
 git status -sb
 git diff --check
-npx gitnexus detect-changes --scope all
+npx gitnexus detect-changes --scope all --repo anxinyan
 ```
 
 Before changing code symbols, follow the repository `AGENTS.md` GitNexus rule: run upstream impact analysis for the target symbol and report the blast radius. Before committing any change, run GitNexus detect changes.
 
+Use GitNexus with the branch workflow:
+
+- Before changing unfamiliar code, use GitNexus query/context to locate the relevant flow.
+- Before editing any function, class, or method, run upstream impact analysis for that symbol.
+- Before committing, run detect-changes against the current diff; this remains a required check even when hooks are enabled.
+- After commits, merges, branch checkouts, and rewrites, local hooks refresh the index with `npx gitnexus analyze --index-only --name anxinyan .`.
+
+Enable the versioned lightweight hooks once per clone:
+
+```bash
+git config core.hooksPath scripts/git-hooks
+```
+
+The hook refresh is best-effort and non-blocking. Disable it temporarily with `GITNEXUS_AUTO_REFRESH=0` if needed. Manual refresh is available with:
+
+```bash
+./scripts/gitnexus-refresh.sh
+```
+
 For release packaging or deployment preparation, also follow the release checklist and packaging skill. At minimum, run the relevant backend smoke/audit scripts and frontend checks for the surfaces touched.
 
 Production packages should stay under the ignored local `releases/` directory and use `https://api.anxinjianyan.com`. Test packages should stay under the ignored local `releases_dev/` directory and use `https://test.api.anxinjianyan.com`. Hand off both kinds of artifacts separately from Git branches.
 
+For backend local/test validation, confirm `server-api/.env` is ignored before using real database credentials:
+
+```bash
+git check-ignore -v server-api/.env
+```
+
+Before committing environment-related documentation, scan tracked docs and examples to ensure no real `DB_PASSWORD` value is present.
+
 ## Documentation Source
 
 The human-readable branch workflow is documented in: