fix(security): harden uploads and wecom binding

frontend/src/api/upload.ts

@@ -1,20 +1,15 @@
 import api from './index'
-import axios from 'axios'
 
 export const uploadApi = {
-  async getPresignedUrl(filename: string, contentType: string = 'image/jpeg') {
-    return api.post('/upload/presigned-url', null, {
-      params: { filename, content_type: contentType },
+  async uploadImage(file: File) {
+    const data = new FormData()
+    data.append('file', file)
+    return api.post('/upload/image', data, {
+      headers: { 'Content-Type': 'multipart/form-data' },
+      timeout: 60000,
     })
   },
   getDownloadUrl(objectKey: string) {
     return api.get('/upload/download-url', { params: { object_key: objectKey } })
   },
-  // Direct upload to MinIO
-  async uploadFile(uploadUrl: string, file: File) {
-    return axios.put(uploadUrl, file, {
-      headers: { 'Content-Type': file.type },
-      timeout: 60000,
-    })
-  },
 }

frontend/src/views/desktop/ManagerWorkspace.vue

@@ -140,12 +140,13 @@ async function handleDialogPhotoUpload(event: Event) {
     try {
       // Compress before upload to reduce storage & transfer
       const compressed = await compressImage(file, { maxPixels: 1920, quality: 0.8 })
-      // Get presigned URL
-      const presignRes = await api.post('/upload/presigned-url', null, { params: { filename: compressed.name, content_type: compressed.type || 'image/jpeg' } })
-      // Upload directly to MinIO (not through our API)
-      const axios = (await import('axios')).default
-      await axios.put(presignRes.data.upload_url, compressed, { headers: { 'Content-Type': compressed.type || 'image/jpeg' } })
-      const key = presignRes.data.object_key
+      const data = new FormData()
+      data.append('file', compressed)
+      const uploadRes = await api.post('/upload/image', data, {
+        headers: { 'Content-Type': 'multipart/form-data' },
+        timeout: 60000,
+      })
+      const key = uploadRes.data.object_key
       if (!form.value.photos) form.value.photos = []
       form.value.photos.push(key)
       form.value.photos = [...form.value.photos]

frontend/src/views/mobile/VisitForm.vue

@@ -128,8 +128,7 @@ async function handlePhotoUpload(event: Event) {
     try {
       // Compress before upload to reduce storage & transfer
       const compressed = await compressImage(file, { maxPixels: 1920, quality: 0.8 })
-      const res = await uploadApi.getPresignedUrl(compressed.name, compressed.type || 'image/jpeg')
-      await uploadApi.uploadFile(res.data.upload_url, compressed)
+      const res = await uploadApi.uploadImage(compressed)
       uploadedPhotos.value.push(res.data.object_key)
       form.value.photos = [...uploadedPhotos.value]
     } catch (e: any) {