refactor(test): 三份 helper 迁移共享

Task 6 审查遗留①（schema 再演进防漂移）：makeWork / seedPublishedSite /
cleanupSiteRows 三件套自 build-snapshot / build-pipeline / build-gates /
preview-server 四文件（Task 6 审查时三份，Task 7 又落一份）迁
tests/integration/helpers.ts 共享——清场清单（21 语句 FK 反序 + 不可变
触发器开关）此后只改一处。

- makeWork 保持签名；媒体种子载荷改由 prefix 派生（bytes 仍随机唯一，
  魔数校验只看 PNG 签名——行为等价）；shared Work 统一携带 pngA/pngB
- seedPublishedSite 增 keyPrefix 参数（各文件沿用原站点 key 派生前缀
  sfbuild/sfpipe/sfgate/sfpreview）；succeeded_with_issues 与
  publishedCount=3 断言随迁（gallery 203/204 悬空语义文件无关）
- import 域短清单清场与 publish 域各自形状不同，不共用——保留原处

零行为变更由 408 测试守护（全绿：根 382 + 主题 26）；lint/typecheck 五段过。

Co-Authored-By: Claude Code <noreply@anthropic.com>

tests/integration/preview-server.test.ts

@@ -20,99 +20,25 @@
 // 13. quiet 开关：quiet:true 静默逐请求日志；缺省（verbose）逐请求一行 stdout
 import { execFile, spawn } from 'node:child_process'
 import { createHash } from 'node:crypto'
-import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises'
 import { request } from 'node:http'
-import { tmpdir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
 import type { RouteManifest, RouteManifestRoute } from '@sf/contracts'
 import { createBuildJob } from '../../apps/api/src/modules/build/build.service.js'
-import { createImportJob } from '../../apps/api/src/modules/import/import.service.js'
-import { publishSiteContent } from '../../apps/api/src/modules/publish/publish.service.js'
-import { registerSource } from '../../apps/api/src/modules/source/register.service.js'
 import { getDb } from '../../apps/api/src/db/client.js'
-import { rand, withImmutableCleanup, type Db } from './helpers.js'
+import { cleanupSiteRows, makeWork, seedPublishedSite, type Db, type Work } from './helpers.js'
 import { createPreviewServer, type PreviewServerHandle } from '../../apps/preview-server/server.mjs'
 
 /** 本文件位于 <repo>/tests/integration/ → 上两级是仓库根 */
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../..')
-const FIXTURES_ROOT = fileURLToPath(new URL('../fixtures', import.meta.url))
-const WXR_FIXTURE = resolve(FIXTURES_ROOT, 'wxr', 'mini.xml')
 const TSX_CLI = join(REPO_ROOT, 'node_modules', 'tsx', 'dist', 'cli.mjs')
 
-const PNG_SIG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])
-
-function mediaBytes(seed: string): Buffer {
-  return Buffer.concat([PNG_SIG, Buffer.from(`media-body:${seed}`, 'latin1')])
-}
 function sha256of(buf: Buffer | string): string {
   return createHash('sha256').update(buf).digest('hex')
 }
 
-interface Work {
-  work: string
-  storageRoot: string
-  allowedRoots: string[]
-  pngA: Buffer
-}
-
-async function makeWork(prefix: string): Promise<Work> {
-  const work = await mkdtemp(join(tmpdir(), `${prefix}-`))
-  const mediaDir = join(work, 'media')
-  await mkdir(join(mediaDir, '2026', '10'), { recursive: true })
-  const pngA = mediaBytes(`preview-a-${rand()}`)
-  await writeFile(join(mediaDir, '2026', '10', 'fixture-a.png'), pngA)
-  await writeFile(join(mediaDir, '2026', '10', 'fixture-b.png'), mediaBytes(`preview-b-${rand()}`))
-  return { work, storageRoot: join(work, 'storage'), allowedRoots: [FIXTURES_ROOT, work], pngA }
-}
-
-/** mini 全链（register wxr+media → import → publish）：3 条 published（build-pipeline 同款） */
-async function seedPublishedSite(db: Db, w: Work): Promise<{ key: string; siteId: string }> {
-  const key = `sfpreview-${rand()}`
-  const reg = await registerSource(db, {
-    siteKey: key,
-    wxrPath: WXR_FIXTURE,
-    mediaDir: join(w.work, 'media'),
-    allowedRoots: w.allowedRoots,
-    storageRoot: w.storageRoot,
-    reportRoot: join(w.work, 'artifacts', 'register'),
-  })
-  const result = await createImportJob(db, { siteKey: key, reportRoot: join(w.work, 'artifacts', 'import') })
-  expect(result.status).toBe('succeeded_with_issues')
-  const dry = await publishSiteContent(db, { siteKey: key, dryRun: true })
-  const run = await publishSiteContent(db, { siteKey: key, confirmToken: dry.confirmToken! })
-  expect(run.publishedCount).toBe(3)
-  return { key, siteId: reg.siteId }
-}
-
-/** 本文件写入的行清场（build-pipeline 同款反序：validation 域先行 + 构建域 + 全链） */
-async function cleanupSiteRows(db: Db, siteId: string): Promise<void> {
-  await db.execute(`delete from validation_issues where validation_run_id in
-    (select id from validation_runs where site_id = '${siteId}')`)
-  await db.execute(`delete from validation_runs where site_id = '${siteId}'`)
-  await db.execute(`delete from build_artifacts where build_job_id in
-    (select id from build_jobs where site_id = '${siteId}')`)
-  await withImmutableCleanup(db, 'build_input_snapshots', 'build_input_snapshots_immutable', `site_id = '${siteId}'`)
-  await db.execute(`delete from build_jobs where site_id = '${siteId}'`)
-  await withImmutableCleanup(db, 'audit_logs', 'audit_logs_immutable', `site_id = '${siteId}'`)
-  await db.execute(`delete from site_config_revisions where site_id = '${siteId}'`)
-  await db.execute(`delete from route_registry where site_id = '${siteId}'`)
-  await db.execute(`delete from media_usages where site_id = '${siteId}'`)
-  await db.execute(`delete from media_assets where site_id = '${siteId}'`)
-  await db.execute(`delete from content_terms where site_id = '${siteId}'`)
-  await db.execute(`delete from terms where site_id = '${siteId}'`)
-  await db.execute(`delete from taxonomies where site_id = '${siteId}'`)
-  await db.execute(`delete from source_records where site_id = '${siteId}'`)
-  await db.execute(`delete from entry_locales where site_id = '${siteId}'`)
-  await withImmutableCleanup(db, 'content_revisions', 'content_revisions_immutable', `site_id = '${siteId}'`)
-  await db.execute(`delete from content_entries where site_id = '${siteId}'`)
-  await db.execute(`delete from import_jobs where site_id = '${siteId}'`)
-  await withImmutableCleanup(db, 'source_snapshots', 'source_snapshots_immutable', `site_id = '${siteId}'`)
-  await db.execute(`delete from source_connections where site_id = '${siteId}'`)
-  await db.execute(`delete from sites where id = '${siteId}'`)
-}
-
 /** 原样路径请求（fetch/URL 会规范化 '/../' 等点段——穿越用例必须走 node:http 裸发） */
 function rawRequest(
   port: number,
@@ -142,7 +68,7 @@ describe('预览服务器（真实构建产物 + 手构 manifest 扩展）', ()
   beforeAll(async () => {
     db = getDb()
     work = await makeWork('sf-preview')
-    const seed = await seedPublishedSite(db, work)
+    const seed = await seedPublishedSite(db, work, 'sfpreview')
     siteId = seed.siteId
     const result = await createBuildJob(db, {
       siteKey: seed.key,