refactor(web,health): 消除硬编码路径 — 统一 resolveMediaUrl + 动态 base_url

1. 新增 resolveMediaUrl() 工具函数，统一处理 storage_path 前缀和 JWT token
2. MediaLibrary 和 MediaPicker 改用 resolveMediaUrl，消除重复逻辑
3. banner_handler 不再硬编码 localhost:3000，改为从 Host header 动态构建 base_url

apps/web/src/components/MediaPicker/index.tsx

@@ -1,6 +1,7 @@
 import { useState, useEffect, useCallback } from 'react';
 import { Modal, Input, Upload, Image, Empty, Spin, message } from 'antd';
 import { SearchOutlined, UploadOutlined } from '@ant-design/icons';
+import { resolveMediaUrl } from '../../utils/media';
 import { mediaApi, type MediaItem } from '../../api/health/media';
 import { uploadFile } from '../../api/upload';
 
@@ -58,9 +59,7 @@ export default function MediaPicker({ open, onClose, onSelect, accept = 'image/*
   };
 
   const handleSelect = (item: MediaItem) => {
-    const token = localStorage.getItem('access_token');
-    const rawPath = (item.storage_path || '').replace(/^\.\//, '/');
-    const url = token ? `${rawPath}?token=${token}` : rawPath;
+    const url = resolveMediaUrl(item.storage_path);
     onSelect(url, item);
     onClose();
   };
@@ -137,11 +136,7 @@ export default function MediaPicker({ open, onClose, onSelect, accept = 'image/*
                 <div style={{ width: '100%', height: 100, display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
                   {item.content_type.startsWith('image/') ? (
                     <Image
-                      src={(() => {
-                        const token = localStorage.getItem('access_token');
-                        const base = (item.thumbnail_path || item.storage_path || '').replace(/^\.\//, '/');
-                        return token ? `${base}?token=${token}` : base;
-                      })()}
+                      src={resolveMediaUrl(item.thumbnail_path || item.storage_path)}
                       alt={item.alt_text || item.filename}
                       style={{ maxWidth: '100%', maxHeight: 100, objectFit: 'cover' }}
                       preview={false}