feat(health,ai): 后端服务优化 + 媒体文件处理

- erp-health: article/banner/consultation/media 服务层优化
- erp-ai: analysis/insight/prompt 服务增强
- erp-auth: auth/role/token 服务改进
- erp-workflow: executor 执行引擎修复
- erp-plugin: 服务层改进
- 新增媒体上传文件样例

crates/erp-health/src/handler/banner_handler.rs

@@ -133,3 +133,37 @@ where
     let result = banner_service::list_public_banners(&state, tenant_id).await?;
     Ok(Json(ApiResponse::ok(result)))
 }
+
+/// GET /public/banner-image/{banner_id} — 公开轮播图图片（无需认证，供小程序下载）
+pub async fn serve_banner_image(
+    State(state): State<HealthState>,
+    Path(banner_id): Path<uuid::Uuid>,
+) -> Result<axum::response::Response, AppError> {
+    use axum::http::{StatusCode, header};
+    use axum::response::IntoResponse;
+
+    let path = banner_service::get_banner_image_path(&state, banner_id).await?;
+    let data = tokio::fs::read(&path)
+        .await
+        .map_err(|e| AppError::Internal(format!("读取图片文件失败: {}", e)))?;
+
+    let mime = if path.ends_with(".png") {
+        "image/png"
+    } else if path.ends_with(".gif") {
+        "image/gif"
+    } else if path.ends_with(".webp") {
+        "image/webp"
+    } else {
+        "image/jpeg"
+    };
+
+    Ok((
+        StatusCode::OK,
+        [
+            (header::CONTENT_TYPE, mime),
+            (header::CACHE_CONTROL, "public, max-age=3600"),
+        ],
+        data,
+    )
+        .into_response())
+}