上线版: 产品表单统一+form嵌套修复+用户管理+部署+三套叙事

- 产品编辑入口统一走 ProductFormFull(卖点/风格/人群/品牌词全字段);
  修复开任务页 <form> 套 <form> 致"编辑产品"报错、改不了、跳回首个产品
- dashboard 入口卡片对齐实际路由: 系统管理(/config) 与 工作配置(/settings) 分开;
  settings ?tab=products 直达改用挂载后读 URL, 消除 hydration mismatch
- 新增用户管理(users API/admin service/改密页) + alembic 022/023/024
- 上线部署: Dockerfile / docker-compose.prod+https / nginx https / .env.example
- A8 三套正交叙事(痛点/场景/成分背书) + beige 调色去AI化 + 飞轮 text_import 高权重信号

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/test_delivery_readiness_fixes.py

@@ -0,0 +1,106 @@
+import json
+from pathlib import Path
+
+import pytest
+
+from app.api.v1 import task_actions
+from app.core.response import CloverHTTPException
+from app.services.fission_service import _source_copy_from_payload
+
+
+class _Query:
+    def __init__(self, rows):
+        self._rows = rows
+
+    def filter(self, *args, **kwargs):
+        return self
+
+    def all(self):
+        return self._rows
+
+
+class _Db:
+    def __init__(self, text_rows, image_rows):
+        self._queries = [_Query(text_rows), _Query(image_rows)]
+
+    def query(self, *args, **kwargs):
+        return self._queries.pop(0)
+
+
+class _Task:
+    id = 7
+    image_count = 3
+
+
+def test_submit_review_requires_each_strategy_to_select_full_image_count():
+    db = _Db(
+        text_rows=[("A",), ("B",), ("C",)],
+        image_rows=[("A", 1), ("A", 2), ("A", 3), ("B", 4), ("C", 5), ("C", 6), ("C", 7)],
+    )
+
+    with pytest.raises(CloverHTTPException) as exc:
+        task_actions._validate_strategy_selection(db, _Task())
+
+    assert "图片未选满：B(1/3)" in exc.value.biz_message
+
+
+def test_submit_review_passes_when_all_strategies_have_text_and_full_images():
+    db = _Db(
+        text_rows=[("A",), ("B",), ("C",)],
+        image_rows=[
+            ("A", 1), ("A", 2), ("A", 3),
+            ("B", 4), ("B", 5), ("B", 6),
+            ("C", 7), ("C", 8), ("C", 9),
+        ],
+    )
+
+    task_actions._validate_strategy_selection(db, _Task())
+
+
+def test_fission_source_extracts_copy_body_from_json_candidate():
+    payload = json.dumps({
+        "title": "早八伪素颜",
+        "content": "通勤前快速提亮，不卡粉。",
+        "selling_points": ["黄皮友好", "妆感轻"],
+    }, ensure_ascii=False)
+
+    source = _source_copy_from_payload(payload)
+
+    assert "早八伪素颜" in source
+    assert "通勤前快速提亮" in source
+    assert "selling_points" not in source
+    assert "{" not in source
+
+
+def test_delivery_status_get_is_read_only_contract():
+    from app.api.v1 import delivery
+
+    assert "commit" not in delivery.get_package_download.__code__.co_names
+    assert "commit" not in delivery.download_package_file.__code__.co_names
+    assert "commit" in delivery.mark_package_downloaded.__code__.co_names
+
+
+def test_workspace_switch_response_includes_role_contract():
+    from app.api.v1 import workspaces
+
+    constants = workspaces.switch_workspace.__code__.co_consts
+
+    assert ("current_workspace_id", "role", "token") in constants
+
+
+def test_production_cors_filters_wildcard():
+    source = Path("main.py").read_text()
+
+    assert "CORS_ALLOW_ORIGINS" in Path("app/core/config.py").read_text()
+    assert 'origin != "*"' in source
+    assert "allow_origins=_cors_origins()" in source
+
+
+def test_production_rejects_default_seed_password_contract():
+    source = Path("app/services/auth_service.py").read_text()
+    seed_source = Path("scripts/seed_data.py").read_text()
+
+    assert 'DEFAULT_SEED_PASSWORD = "Clover2026!"' in source
+    assert 'APP_ENV == "production"' in source
+    assert "默认密码已禁用" in source
+    assert "Production seed requires CLOVER_SEED_PASSWORD" in seed_source