refactor(web,health): 消除硬编码路径 — 统一 resolveMediaUrl + 动态 base_url

1. 新增 resolveMediaUrl() 工具函数，统一处理 storage_path 前缀和 JWT token
2. MediaLibrary 和 MediaPicker 改用 resolveMediaUrl，消除重复逻辑
3. banner_handler 不再硬编码 localhost:3000，改为从 Host header 动态构建 base_url

apps/web/src/pages/health/MediaLibrary.tsx

@@ -8,6 +8,7 @@ import {
   EllipsisOutlined, InboxOutlined, ReloadOutlined,
 } from '@ant-design/icons';
 import type { UploadProps } from 'antd';
+import { resolveMediaUrl } from '../../utils/media';
 import { mediaApi, mediaFolderApi, type MediaItem, type FolderItem } from '../../api/health/media';
 import { AuthButton } from '../../components/AuthButton';
 import { formatDateTime } from '../../utils/format';
@@ -158,11 +159,7 @@ export default function MediaLibrary() {
         cover={
           <div onClick={() => toggleSelect(item.id)} style={{ height: 140, display: 'flex', alignItems: 'center', justifyContent: 'center', background: 'var(--ant-color-fill-quaternary, #f5f5f5)', overflow: 'hidden', position: 'relative', cursor: 'pointer' }}>
             {isImage(item.content_type) ? (
-              <img src={(() => {
-                const base = (item.thumbnail_path || item.storage_path).replace(/^\.\//, '/');
-                const token = localStorage.getItem('access_token');
-                return token ? `${base}?token=${token}` : base;
-              })()} alt={item.alt_text || item.filename} style={{ width: '100%', height: '100%', objectFit: 'cover' }} />
+              <img src={resolveMediaUrl(item.thumbnail_path || item.storage_path)} alt={item.alt_text || item.filename} style={{ width: '100%', height: '100%', objectFit: 'cover' }} />
             ) : (
               <InboxOutlined style={{ fontSize: 36, color: 'var(--ant-color-text-quaternary)' }} />
             )}