fix(security): CORS限制+SSRF防护+PATCH乐观锁+accounts安全cap(4 important bugs)

- main.py + config.py: CORS origins read from Settings.cors_origins (comma-separated).
  Empty falls back to dev origin localhost:5173; never wildcard. Methods locked
  to GET/PATCH/POST; allow_credentials=False.
- scraper/media.py: download_url now passes follow_redirects=False to httpx.
  OSS URLs return 200 directly; a 3xx is treated as a download failure (caught
  by existing except clauses) instead of opening an SSRF vector to internal hosts.
- routers/voice_clips.py: PATCH /voice-clips/{id}/match accepts an optional
  If-Match header carrying the client's last-seen updated_at. On mismatch the
  row was modified by another request and the server returns 409. Without the
  header the behaviour is unchanged (backward compatible). Response now echoes
  the post-update updated_at so the client can fold it into the next request.
- routers/organization.py: /api/accounts now UNION ALLs the wechat_account and
  whatsapp_account projections at the SQL level and pushes COUNT + pagination
  (offset/limit) down to the DB. Stable ordering on (channel, account_id).
  Removes the in-memory materialization that broke at scale.

Tests: 395 passed. Added optimistic-lock coverage (If-Match accepted / stale 409 /
absent header backward-compat). Updated existing PATCH tests for the new
updated_at response field.

Co-Authored-By: Claude <noreply@anthropic.com>

yunke-server/tests/test_api_voice_clips.py

@@ -268,7 +268,12 @@ async def test_match_returns_payload_and_persists(make_client):
     r = await client.patch("/api/voice-clips/1/match", json={"friend_id": "fid_remark"})
     assert r.status_code == 200
     body = r.json()
-    assert body == {"voice_clip_id": 1, "matched_friend_id": "fid_remark"}
+    # Response now carries the post-update ``updated_at`` for the optimistic-
+    # lock flow (client folds it into the next request's ``If-Match`` header).
+    assert body["voice_clip_id"] == 1
+    assert body["matched_friend_id"] == "fid_remark"
+    assert "updated_at" in body
+    updated_at_v1 = body["updated_at"]
 
     # The GET list now reflects the match (cross-request persistence —
     # requires the PATCH to commit, not just flush).
@@ -280,6 +285,7 @@ async def test_match_returns_payload_and_persists(make_client):
     # The other wechat clip for u1 is still unmatched.
     assert by_id[3]["matched_friend_id"] is None
     assert by_id[3]["matched_friend_name"] is None
+    return updated_at_v1  # for reuse by optimistic-lock tests below if needed
 
 
 async def test_match_name_falls_back_through_nickname_real_name(make_client):
@@ -332,7 +338,10 @@ async def test_unmatch_clears_friend_id(make_client):
     # Now clear it.
     r = await client.patch("/api/voice-clips/1/match", json={"friend_id": None})
     assert r.status_code == 200
-    assert r.json() == {"voice_clip_id": 1, "matched_friend_id": None}
+    body = r.json()
+    assert body["voice_clip_id"] == 1
+    assert body["matched_friend_id"] is None
+    assert "updated_at" in body
 
     r2 = await client.get("/api/voice-clips", params={"user_id": "u1"})
     by_id = {it["voice_clip_id"]: it for it in r2.json()["items"]}
@@ -356,4 +365,88 @@ async def test_match_default_null_body_is_treated_as_unmatch(make_client):
     # Empty body -> body.friend_id defaults to None -> unmatch.
     r = await client.patch("/api/voice-clips/1/match", json={})
     assert r.status_code == 200
-    assert r.json()["matched_friend_id"] is None
+    body = r.json()
+    assert body["matched_friend_id"] is None
+    assert "updated_at" in body
+
+
+# ---------------------------------------------------------------------------
+# Optimistic lock — If-Match header on PATCH /api/voice-clips/{id}/match
+# ---------------------------------------------------------------------------
+
+
+async def test_match_with_if_match_accepts_current_updated_at(make_client):
+    """If-Match equal to the row's current ``updated_at`` is accepted (200).
+
+    The flow: GET to read the current ``updated_at`` (via a successful PATCH
+    echo), send that value as ``If-Match`` on the next PATCH — the server
+    accepts the request because the row has not changed in between.
+    """
+    client = await make_client(_seed_with_customer)
+    # First PATCH establishes the match and returns the post-update timestamp.
+    r1 = await client.patch(
+        "/api/voice-clips/1/match", json={"friend_id": "fid_remark"}
+    )
+    assert r1.status_code == 200
+    current = r1.json()["updated_at"]
+    assert current is not None
+
+    # Second PATCH with If-Match=current: accepted (200), match cleared.
+    r2 = await client.patch(
+        "/api/voice-clips/1/match",
+        json={"friend_id": None},
+        headers={"If-Match": current},
+    )
+    assert r2.status_code == 200
+    assert r2.json()["matched_friend_id"] is None
+
+
+async def test_match_with_stale_if_match_returns_409(make_client):
+    """An If-Match that doesn't match the row's current ``updated_at`` -> 409.
+
+    Simulates the lost-update race: client A reads the clip, client B modifies
+    it (bumping ``updated_at``), then client A's PATCH carrying A's now-stale
+    timestamp is rejected. We force a clearly stale value rather than relying
+    on wall-clock drift because SQLite's ``CURRENT_TIMESTAMP`` (the dialect
+    compilation of ``func.now()``) has 1-second resolution and two PATCHes
+    inside the same second produce identical timestamps.
+    """
+    client = await make_client(_seed_with_customer)
+    # First PATCH: succeeds, returns the post-update timestamp.
+    r1 = await client.patch(
+        "/api/voice-clips/1/match", json={"friend_id": "fid_remark"}
+    )
+    assert r1.status_code == 200
+    current = r1.json()["updated_at"]
+    assert current is not None
+
+    # Any string that differs from the row's current updated_at is "stale" —
+    # 409. We use an obviously-older timestamp so the test is deterministic.
+    stale = "2000-01-01T00:00:00"
+    assert stale != current
+
+    r2 = await client.patch(
+        "/api/voice-clips/1/match",
+        json={"friend_id": None},
+        headers={"If-Match": stale},
+    )
+    assert r2.status_code == 409
+    assert "modified" in r2.json()["detail"].lower()
+
+
+async def test_match_without_if_match_is_backward_compatible(make_client):
+    """No If-Match header -> no optimistic-lock check; behavior unchanged."""
+    client = await make_client(_seed_with_customer)
+    # First PATCH establishes a value.
+    r1 = await client.patch(
+        "/api/voice-clips/1/match", json={"friend_id": "fid_remark"}
+    )
+    assert r1.status_code == 200
+
+    # Second PATCH WITHOUT If-Match — accepted regardless of staleness
+    # (backward compatible: clients that don't send the header keep working).
+    r2 = await client.patch(
+        "/api/voice-clips/1/match", json={"friend_id": "fid_nick"}
+    )
+    assert r2.status_code == 200
+    assert r2.json()["matched_friend_id"] == "fid_nick"