fix(file): 修复商品详情截图与提现打款凭证等私有图片 403 权限问题

- 放宽公开商品截图 key 提取规则，支持任意合规 object key 转换为免鉴权公开端点
- 补充后台截图上传 listing_screenshot 与 operating-expense 场景识别
- dependencies 授权器支持已审核上架商品截图兜底放行、提现人打款凭证鉴权及变体后缀匹配
- /api/files 路由组支持用户与管理员双重鉴权 (AuthUserOrAdmin)
- 前端收款账号凭证与提现详情凭证统一升级为 AuthImage 组件并支持大图预览

frontend/src/features/admin/components/ImageEditorDialog.vue

@@ -484,7 +484,7 @@ async function handleSave() {
     }
 
     const file = new File([blob], `edited_screenshot_${Date.now()}.jpg`, { type: 'image/jpeg' })
-    const uploaded = await uploadAdminFile(file, 'listing_screenshot')
+    const uploaded = await uploadAdminFile(file, 'listing')
     if (!uploaded || !uploaded.url) {
       throw new Error('上传截图失败')
     }

frontend/src/features/admin/components/WithdrawalDetailDialog.vue

@@ -289,9 +289,13 @@ function accountTypeLabel(type: string) {
             {{ withdrawal.payment_remark }}
           </el-descriptions-item>
           <el-descriptions-item v-if="withdrawal.payment_proof_url" label="打款凭证" :span="2">
-            <el-link :href="withdrawal.payment_proof_url" target="_blank" type="primary">
-              查看凭证
-            </el-link>
+            <AuthImage
+              :source="withdrawal.payment_proof_url"
+              admin
+              alt="打款凭证"
+              class="certificate-image"
+              :preview-src-list="[withdrawal.payment_proof_url]"
+            />
           </el-descriptions-item>
         </el-descriptions>
       </div>

frontend/src/features/wallet/components/PaymentAccountDialog.vue

@@ -13,6 +13,7 @@ import {
   type UpdatePaymentAccountRequest,
 } from '../api/withdrawal'
 import { uploadFile } from '@/shared/api/files'
+import AuthImage from '@/shared/components/business/AuthImage.vue'
 
 const props = defineProps<{
   modelValue: boolean
@@ -255,7 +256,13 @@ function removeImage(index: number) {
         </div>
         <div class="certificate-upload">
           <div v-for="(url, index) in form.certificate_urls" :key="url" class="certificate-item">
-            <img :src="url" alt="凭证" />
+            <AuthImage
+              :source="url"
+              alt="凭证"
+              fit="cover"
+              :preview-src-list="form.certificate_urls"
+              :preview-initial-index="index"
+            />
             <el-button
               :icon="Delete"
               circle
@@ -410,6 +417,8 @@ function removeImage(index: number) {
   overflow: hidden;
 }
 
+.certificate-item :deep(img),
+.certificate-item :deep(.auth-image-img),
 .certificate-item img {
   width: 100%;
   height: 100%;

frontend/src/features/wallet/views/MobileWithdrawalView.css

@@ -455,7 +455,9 @@
   border: 1px solid #fed7aa;
 }
 
-.certificate-item img {
+.certificate-item img,
+.certificate-item :deep(img),
+.certificate-item :deep(.auth-image-img) {
   display: block;
   width: 100%;
   height: 100%;

frontend/src/features/wallet/views/MobileWithdrawalView.vue

@@ -18,6 +18,7 @@ import {
 } from '@/features/wallet/api/withdrawal'
 import { fetchWalletBalance, type WalletAccount } from '@/features/wallet/api/wallet'
 import { uploadFile } from '@/shared/api/files'
+import AuthImage from '@/shared/components/business/AuthImage.vue'
 import { readError } from '@/shared/utils/error'
 import { formatCent, formatMoney, yuanToCent } from '@/shared/utils/money'
 import { formatDateMinute } from '@/shared/utils/time'
@@ -628,7 +629,13 @@ function statusType(status: string): 'primary' | 'success' | 'danger' | 'warning
               :key="url"
               class="certificate-item"
             >
-              <img :src="url" alt="收款凭证" />
+              <AuthImage
+                :source="url"
+                alt="收款凭证"
+                fit="cover"
+                :preview-src-list="accountForm.certificate_urls"
+                :preview-initial-index="index"
+              />
               <button type="button" class="certificate-remove" @click="removeCertificate(index)">
                 <van-icon name="cross" :size="13" />
               </button>