feat: 完善媒体管理与备份迁移流程

- 视频上传生成缩略图并提供占位封面和失败原因展示
- 支持 HLS 按需重新封装 MP4，并限制临时文件生命周期与访问权限
- 完善视频、文件 API 文档、搜索、批量删除和单次转码质量参数
- 修复备份恢复与跨后端迁移遗漏缩略图、HLS 清单和分片的问题
- 将备份任务、归档和下载权限按用户隔离
- 增加仅清理当前用户数据的高危存储清空流程和二次文字确认
- 修复 S3 中文文件名元数据及 CLI 数据库连接问题
- 补充备份恢复、用户隔离、媒体资源和转码相关测试

server/api/admin/backup/jobs/[id]/cancel.post.ts

@@ -5,16 +5,19 @@ import { getBackupJob } from '../../../../../utils/backup/jobs'
 import { cancelBackupJob } from '../../../../../utils/backup/runner'
 
 export default defineEventHandler(async (event) => {
-  await requireAdminAuth(event)
+  const user = await requireAdminAuth(event)
   const id = getRouterParam(event, 'id')
   if (!id) {
     createApiError(event, 'INVALID_REQUEST', '缺少任务 ID', 400)
   }
 
+  if (!getBackupJob(id, user.id)) {
+    createApiError(event, 'INVALID_REQUEST', '任务不存在', 404)
+  }
   if (!cancelBackupJob(id)) {
     createApiError(event, 'INVALID_REQUEST', '只能取消进行中的任务', 400)
   }
 
-  const job = getBackupJob(id)
+  const job = getBackupJob(id, user.id)
   return { job: job ? serializeBackupJob(job) : null }
 })

server/api/admin/backup/jobs/[id]/download.get.ts

@@ -6,13 +6,13 @@ import { getBackupJob } from '../../../../../utils/backup/jobs'
 import { BACKUP_ARCHIVE_EXT } from '../../../../../utils/backup/paths'
 
 export default defineEventHandler(async (event) => {
-  await requireAdminAuth(event)
+  const user = await requireAdminAuth(event)
   const id = getRouterParam(event, 'id')
   if (!id) {
     createApiError(event, 'INVALID_REQUEST', '缺少任务 ID', 400)
   }
 
-  const job = getBackupJob(id)
+  const job = getBackupJob(id, user.id)
   if (!job || job.type !== 'full_export' || job.status !== 'done' || !job.outputPath) {
     createApiError(event, 'INVALID_REQUEST', '可下载的备份不存在', 404)
   }

server/api/admin/backup/jobs/[id]/retry.post.ts

@@ -5,13 +5,13 @@ import { serializeBackupJob } from '../../../../../utils/backup/api'
 import { getBackupJob } from '../../../../../utils/backup/jobs'
 
 export default defineEventHandler(async (event) => {
-  await requireAdminAuth(event)
+  const user = await requireAdminAuth(event)
   const id = getRouterParam(event, 'id')
   if (!id) {
     createApiError(event, 'INVALID_REQUEST', '缺少任务 ID', 400)
   }
 
-  const job = getBackupJob(id)
+  const job = getBackupJob(id, user.id)
   if (!job || job.type !== 'backend_sync') {
     createApiError(event, 'INVALID_REQUEST', '任务不存在', 404)
   }
@@ -23,6 +23,6 @@ export default defineEventHandler(async (event) => {
     createApiError(event, 'INVALID_REQUEST', message, 400)
   }
 
-  const updated = getBackupJob(id)
+  const updated = getBackupJob(id, user.id)
   return { job: updated ? serializeBackupJob(updated) : null }
 })