fix(security): CORS限制+SSRF防护+PATCH乐观锁+accounts安全cap(4 important bugs)

- main.py + config.py: CORS origins read from Settings.cors_origins (comma-separated).
  Empty falls back to dev origin localhost:5173; never wildcard. Methods locked
  to GET/PATCH/POST; allow_credentials=False.
- scraper/media.py: download_url now passes follow_redirects=False to httpx.
  OSS URLs return 200 directly; a 3xx is treated as a download failure (caught
  by existing except clauses) instead of opening an SSRF vector to internal hosts.
- routers/voice_clips.py: PATCH /voice-clips/{id}/match accepts an optional
  If-Match header carrying the client's last-seen updated_at. On mismatch the
  row was modified by another request and the server returns 409. Without the
  header the behaviour is unchanged (backward compatible). Response now echoes
  the post-update updated_at so the client can fold it into the next request.
- routers/organization.py: /api/accounts now UNION ALLs the wechat_account and
  whatsapp_account projections at the SQL level and pushes COUNT + pagination
  (offset/limit) down to the DB. Stable ordering on (channel, account_id).
  Removes the in-memory materialization that broke at scale.

Tests: 395 passed. Added optimistic-lock coverage (If-Match accepted / stale 409 /
absent header backward-compat). Updated existing PATCH tests for the new
updated_at response field.

Co-Authored-By: Claude <noreply@anthropic.com>

yunke-server/app/config.py

@@ -34,6 +34,15 @@ class Settings(BaseSettings):
     # <token>`` or ``?token=<token>``. See app/api/auth.py.
     api_token: str = ""
 
+    # Comma-separated list of allowed CORS origins for the viewing API. Empty
+    # (default) -> only the dev fallback (``http://localhost:5173``) is allowed;
+    # set ``CORS_ORIGINS=https://app.example.com`` in prod to lock cross-origin
+    # access down to explicit origins. Never ``*`` (wildcard + credentialed APIs
+    # are an open door; we accept no credentials but still restrict origins to
+    # avoid reflecting arbitrary attacker-controlled origins in ``Acces-Control-
+    # Allow-Origin``).
+    cors_origins: str = ""
+
     # --- Anti-risk-control / stealth tuning ---------------------------------
     # Tuned 2026-08-11 after triggering 风控 during a heavy session (~500+
     # consecutive requests across groups/WA/voice-clips/SMS in ~1 hour).