server: 平台抽象层+bilibili、服务端加密凭据库、角色中间件；web: 精简页面/路由、macOS 客户端(Swift)与多份方案文档；移除误入库的编译产物

server/internal/api/handlers/material.go

@@ -95,7 +95,8 @@ func (h *MaterialHandler) Upload(c *gin.Context) {
 		return
 	}
 	kind := "image"
-	if strings.HasPrefix(header.Header.Get("Content-Type"), "video/") {
+	contentType := strings.ToLower(header.Header.Get("Content-Type"))
+	if strings.HasPrefix(contentType, "video/") || isVideoExtension(ext) {
 		kind = "video"
 	}
 	group := strings.TrimSpace(c.PostForm("group"))
@@ -125,6 +126,15 @@ func (h *MaterialHandler) Upload(c *gin.Context) {
 	response.OK(c, gin.H{"material": material, "dedup": false})
 }
 
+func isVideoExtension(ext string) bool {
+	switch strings.ToLower(ext) {
+	case ".mp4", ".mov", ".avi", ".mkv", ".m4v", ".webm", ".flv", ".wmv":
+		return true
+	default:
+		return false
+	}
+}
+
 // URL 生成签名直链（10 分钟一次性）
 func (h *MaterialHandler) URL(c *gin.Context) {
 	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
@@ -171,10 +181,15 @@ func (h *MaterialHandler) ServeFile(c *gin.Context) {
 	_ = h.DB.Delete(&token).Error
 	abspath := filepath.Join(h.Cfg.StorageDir, material.StorageKey)
 	clean := filepath.Clean(abspath)
-	if !strings.HasPrefix(clean, filepath.Clean(h.Cfg.StorageDir)) {
+	root := filepath.Clean(h.Cfg.StorageDir) + string(os.PathSeparator)
+	if !strings.HasPrefix(clean, root) {
 		response.Fail(c, http.StatusForbidden, 1003, "非法路径")
 		return
 	}
+	if c.Query("inline") == "1" {
+		c.File(abspath)
+		return
+	}
 	c.FileAttachment(abspath, material.Name)
 }