上线版: 产品表单统一+form嵌套修复+用户管理+部署+三套叙事

- 产品编辑入口统一走 ProductFormFull(卖点/风格/人群/品牌词全字段);
  修复开任务页 <form> 套 <form> 致"编辑产品"报错、改不了、跳回首个产品
- dashboard 入口卡片对齐实际路由: 系统管理(/config) 与 工作配置(/settings) 分开;
  settings ?tab=products 直达改用挂载后读 URL, 消除 hydration mismatch
- 新增用户管理(users API/admin service/改密页) + alembic 022/023/024
- 上线部署: Dockerfile / docker-compose.prod+https / nginx https / .env.example
- A8 三套正交叙事(痛点/场景/成分背书) + beige 调色去AI化 + 飞轮 text_import 高权重信号

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/test_delivery_readiness_fixes.py

@@ -0,0 +1,106 @@
+import json
+from pathlib import Path
+
+import pytest
+
+from app.api.v1 import task_actions
+from app.core.response import CloverHTTPException
+from app.services.fission_service import _source_copy_from_payload
+
+
+class _Query:
+    def __init__(self, rows):
+        self._rows = rows
+
+    def filter(self, *args, **kwargs):
+        return self
+
+    def all(self):
+        return self._rows
+
+
+class _Db:
+    def __init__(self, text_rows, image_rows):
+        self._queries = [_Query(text_rows), _Query(image_rows)]
+
+    def query(self, *args, **kwargs):
+        return self._queries.pop(0)
+
+
+class _Task:
+    id = 7
+    image_count = 3
+
+
+def test_submit_review_requires_each_strategy_to_select_full_image_count():
+    db = _Db(
+        text_rows=[("A",), ("B",), ("C",)],
+        image_rows=[("A", 1), ("A", 2), ("A", 3), ("B", 4), ("C", 5), ("C", 6), ("C", 7)],
+    )
+
+    with pytest.raises(CloverHTTPException) as exc:
+        task_actions._validate_strategy_selection(db, _Task())
+
+    assert "图片未选满：B(1/3)" in exc.value.biz_message
+
+
+def test_submit_review_passes_when_all_strategies_have_text_and_full_images():
+    db = _Db(
+        text_rows=[("A",), ("B",), ("C",)],
+        image_rows=[
+            ("A", 1), ("A", 2), ("A", 3),
+            ("B", 4), ("B", 5), ("B", 6),
+            ("C", 7), ("C", 8), ("C", 9),
+        ],
+    )
+
+    task_actions._validate_strategy_selection(db, _Task())
+
+
+def test_fission_source_extracts_copy_body_from_json_candidate():
+    payload = json.dumps({
+        "title": "早八伪素颜",
+        "content": "通勤前快速提亮，不卡粉。",
+        "selling_points": ["黄皮友好", "妆感轻"],
+    }, ensure_ascii=False)
+
+    source = _source_copy_from_payload(payload)
+
+    assert "早八伪素颜" in source
+    assert "通勤前快速提亮" in source
+    assert "selling_points" not in source
+    assert "{" not in source
+
+
+def test_delivery_status_get_is_read_only_contract():
+    from app.api.v1 import delivery
+
+    assert "commit" not in delivery.get_package_download.__code__.co_names
+    assert "commit" not in delivery.download_package_file.__code__.co_names
+    assert "commit" in delivery.mark_package_downloaded.__code__.co_names
+
+
+def test_workspace_switch_response_includes_role_contract():
+    from app.api.v1 import workspaces
+
+    constants = workspaces.switch_workspace.__code__.co_consts
+
+    assert ("current_workspace_id", "role", "token") in constants
+
+
+def test_production_cors_filters_wildcard():
+    source = Path("main.py").read_text()
+
+    assert "CORS_ALLOW_ORIGINS" in Path("app/core/config.py").read_text()
+    assert 'origin != "*"' in source
+    assert "allow_origins=_cors_origins()" in source
+
+
+def test_production_rejects_default_seed_password_contract():
+    source = Path("app/services/auth_service.py").read_text()
+    seed_source = Path("scripts/seed_data.py").read_text()
+
+    assert 'DEFAULT_SEED_PASSWORD = "Clover2026!"' in source
+    assert 'APP_ENV == "production"' in source
+    assert "默认密码已禁用" in source
+    assert "Production seed requires CLOVER_SEED_PASSWORD" in seed_source

backend/tests/test_image_provider_routing.py

@@ -0,0 +1,64 @@
+import asyncio
+import base64
+
+from app.services.ai_engine.gemini_factory import AIClients
+
+
+class _Resp:
+    def __init__(self, payload):
+        self.payload = payload
+
+    def raise_for_status(self):
+        return None
+
+    def json(self):
+        return self.payload
+
+
+class _Client:
+    def __init__(self, payload):
+        self.payload = payload
+        self.calls = []
+
+    async def post(self, url, **kwargs):
+        self.calls.append({"url": url, **kwargs})
+        return _Resp(self.payload)
+
+
+def test_apiports_image_edit_uses_chat_completions(monkeypatch):
+    img = base64.b64encode(b"image-bytes").decode()
+    fake = _Client({
+        "choices": [{
+            "message": {
+                "images": [{"b64_json": img}],
+            },
+        }],
+    })
+    client = AIClients(_gpt_token="apiports-token", _gpt_base="https://apiports.example")
+    monkeypatch.setattr(client, "_gpt_target", lambda provider: ("https://apiports.example", "apiports-token", fake))
+
+    out = asyncio.run(client.gpt_edits("keep bottle", [b"ref"], "1024x1536", provider="apiports"))
+
+    assert out == b"image-bytes"
+    assert fake.calls[0]["url"] == "https://apiports.example/chat/completions"
+    payload = fake.calls[0]["json"]
+    assert payload["model"] == client._model_image
+    content = payload["messages"][0]["content"]
+    assert content[0]["type"] == "text"
+    assert content[1]["type"] == "image_url"
+    assert content[1]["image_url"]["url"].startswith("data:image/png;base64,")
+
+
+def test_codeproxy_image_edit_keeps_images_edits(monkeypatch):
+    img = base64.b64encode(b"codeproxy-image").decode()
+    fake = _Client({"data": [{"b64_json": img}]})
+    client = AIClients(_alt_token="codeproxy-token", _alt_base="https://codeproxy.example")
+    monkeypatch.setattr(client, "_gpt_target", lambda provider: ("https://codeproxy.example", "codeproxy-token", fake))
+
+    out = asyncio.run(client.gpt_edits("keep bottle", [b"ref"], "1024x1536", provider="codeproxy"))
+
+    assert out == b"codeproxy-image"
+    assert fake.calls[0]["url"] == "https://codeproxy.example/images/edits"
+    files = fake.calls[0]["files"]
+    assert any(part[0] == "image[]" for part in files)
+    assert any(part[0] == "prompt" for part in files)