fix(security): CORS限制+SSRF防护+PATCH乐观锁+accounts安全cap(4 important bugs)

- main.py + config.py: CORS origins read from Settings.cors_origins (comma-separated).
  Empty falls back to dev origin localhost:5173; never wildcard. Methods locked
  to GET/PATCH/POST; allow_credentials=False.
- scraper/media.py: download_url now passes follow_redirects=False to httpx.
  OSS URLs return 200 directly; a 3xx is treated as a download failure (caught
  by existing except clauses) instead of opening an SSRF vector to internal hosts.
- routers/voice_clips.py: PATCH /voice-clips/{id}/match accepts an optional
  If-Match header carrying the client's last-seen updated_at. On mismatch the
  row was modified by another request and the server returns 409. Without the
  header the behaviour is unchanged (backward compatible). Response now echoes
  the post-update updated_at so the client can fold it into the next request.
- routers/organization.py: /api/accounts now UNION ALLs the wechat_account and
  whatsapp_account projections at the SQL level and pushes COUNT + pagination
  (offset/limit) down to the DB. Stable ordering on (channel, account_id).
  Removes the in-memory materialization that broke at scale.

Tests: 395 passed. Added optimistic-lock coverage (If-Match accepted / stale 409 /
absent header backward-compat). Updated existing PATCH tests for the new
updated_at response field.

Co-Authored-By: Claude <noreply@anthropic.com>

yunke-server/app/api/main.py

@@ -20,8 +20,10 @@ Includes:
 * ``GET /api/search`` (see :mod:`app.api.routers.search`).
 * ``GET /api/export/chat-html`` (see :mod:`app.api.routers.export`).
 
-CORS is configured permissively (wildcard origin, no credentials) so the local
-frontend can call the API during development.
+CORS is configured to read explicit allowed origins from ``Settings.cors_origins``
+(comma-separated ``CORS_ORIGINS`` env var). Empty (default) falls back to the dev
+origin ``http://localhost:5173``; set ``CORS_ORIGINS=https://app.example.com`` in
+prod. Never wildcard — see the comment near ``add_middleware`` below.
 
 Auth (Task 2.9): a single shared-token dependency (:func:`app.api.auth.require_auth`)
 is applied globally on the app. Trust model: when ``Settings.api_token`` is
@@ -52,14 +54,27 @@ from app.api.routers import (
     sync,
     voice_clips,
 )
+from app.config import get_settings
 
 app = FastAPI(title="yunke data mirror", dependencies=[Depends(require_auth)])
 
+# CORS: read explicit allowed origins from Settings (``CORS_ORIGINS`` env var,
+# comma-separated). Empty -> dev fallback (``http://localhost:5173``). Never
+# ``*`` — wildcard CORS on an authenticated API is an open door even without
+# credentials, since the middleware would reflect any attacker-controlled
+# origin back in ``Access-Control-Allow-Origin``.
+_settings = get_settings()
+_cors = _settings.cors_origins.strip()
+if _cors:
+    _origins = [o.strip() for o in _cors.split(",") if o.strip()]
+else:
+    _origins = []  # empty = deny all cross-origin (safest default)
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
-    allow_methods=["*"],
+    allow_origins=_origins or ["http://localhost:5173"],  # dev fallback
+    allow_methods=["GET", "PATCH", "POST"],
     allow_headers=["*"],
+    allow_credentials=False,
 )
 
 app.include_router(customer.router)