feat(health,ai): 后端服务优化 + 媒体文件处理

- erp-health: article/banner/consultation/media 服务层优化
- erp-ai: analysis/insight/prompt 服务增强
- erp-auth: auth/role/token 服务改进
- erp-workflow: executor 执行引擎修复
- erp-plugin: 服务层改进
- 新增媒体上传文件样例

crates/erp-health/src/handler/article_handler.rs

@@ -72,6 +72,15 @@ pub async fn list_public_articles(
     Ok(Json(ApiResponse::ok(result)))
 }
 
+/// GET /public/articles/{id} — 公开文章详情（无需认证，仅返回已发布文章）
+pub async fn get_public_article(
+    State(state): State<HealthState>,
+    Path(id): Path<uuid::Uuid>,
+) -> Result<Json<ApiResponse<ArticleResp>>, AppError> {
+    let result = article_service::get_public_article(&state, id).await?;
+    Ok(Json(ApiResponse::ok(result)))
+}
+
 pub async fn get_article<S>(
     State(state): State<HealthState>,
     Extension(ctx): Extension<TenantContext>,

crates/erp-health/src/handler/banner_handler.rs

@@ -133,3 +133,37 @@ where
     let result = banner_service::list_public_banners(&state, tenant_id).await?;
     Ok(Json(ApiResponse::ok(result)))
 }
+
+/// GET /public/banner-image/{banner_id} — 公开轮播图图片（无需认证，供小程序下载）
+pub async fn serve_banner_image(
+    State(state): State<HealthState>,
+    Path(banner_id): Path<uuid::Uuid>,
+) -> Result<axum::response::Response, AppError> {
+    use axum::http::{StatusCode, header};
+    use axum::response::IntoResponse;
+
+    let path = banner_service::get_banner_image_path(&state, banner_id).await?;
+    let data = tokio::fs::read(&path)
+        .await
+        .map_err(|e| AppError::Internal(format!("读取图片文件失败: {}", e)))?;
+
+    let mime = if path.ends_with(".png") {
+        "image/png"
+    } else if path.ends_with(".gif") {
+        "image/gif"
+    } else if path.ends_with(".webp") {
+        "image/webp"
+    } else {
+        "image/jpeg"
+    };
+
+    Ok((
+        StatusCode::OK,
+        [
+            (header::CONTENT_TYPE, mime),
+            (header::CACHE_CONTROL, "public, max-age=3600"),
+        ],
+        data,
+    )
+        .into_response())
+}

crates/erp-health/src/handler/consultation_handler.rs

@@ -29,6 +29,13 @@ pub struct MessageListParams {
     pub after_id: Option<Uuid>,
 }
 
+#[derive(Debug, Deserialize, IntoParams)]
+pub struct PollMessagesParams {
+    pub after_id: Option<Uuid>,
+    /// 超时秒数，默认 25，最大 30
+    pub timeout: Option<u64>,
+}
+
 #[derive(Debug, serde::Deserialize, utoipa::ToSchema)]
 pub struct CloseSessionReq {
     pub version: i32,
@@ -129,6 +136,30 @@ where
     Ok(Json(ApiResponse::ok(result)))
 }
 
+/// 长轮询咨询消息 — 有新消息立即返回，否则挂起等待（最多 timeout 秒）。
+pub async fn poll_messages<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    Path(session_id): Path<Uuid>,
+    Query(params): Query<PollMessagesParams>,
+) -> Result<Json<ApiResponse<Vec<MessageResp>>>, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.consultation.list")?;
+    let timeout_secs = params.timeout.unwrap_or(25).min(30);
+    let result = consultation_service::poll_new_messages(
+        &state,
+        ctx.tenant_id,
+        session_id,
+        params.after_id,
+        timeout_secs,
+    )
+    .await?;
+    Ok(Json(ApiResponse::ok(result)))
+}
+
 pub async fn close_session<S>(
     State(state): State<HealthState>,
     Extension(ctx): Extension<TenantContext>,