fix(project): 封面图字段兼容完整媒体链接，自动提取 key 入库

封面图字段原仅接受 media key（general/xxx.png），且 DTO/DB 限 64 字符。
用户粘贴完整媒体链接（https://…/api/v1/media/files/general/xxx.png，约 91 字符）
时被 @SiZe(max=64) 拒绝，无法保存；即便存入，前端 coverUrl() 再加前缀也会裂图。

修复：DTO 放宽到 512（允许完整链接进入），ProjectService 归一化——命中
/api/v1/media/files/ 前缀时提取 key 入库（DB 仍 VARCHAR(64)），并对最终 key
校验（无 scheme/空白/路径穿越、≤64）。前端编辑框提示可填 key 或完整链接，
并新增封面实时预览。

Co-Authored-By: Claude Code <noreply@anthropic.com>

Author: yyyCode

OpenBlog-business/src/main/java/com/yqz/openblog/project/dto/ProjectUpsertRequest.java

@@ -15,7 +15,8 @@ public class ProjectUpsertRequest {
     @NotBlank
     private String contentMarkdown;
 
-    @Size(max = 64)
+    /** 允许填完整媒体链接（如 https://…/api/v1/media/files/general/xxx.png），service 会归一化为 key 入库 */
+    @Size(max = 512)
     private String coverMediaKey;
 
     @Size(max = 255)
@@ -43,8 +44,8 @@ public class ProjectUpsertRequest {
     public @NotBlank String getContentMarkdown() { return contentMarkdown; }
     public void setContentMarkdown(@NotBlank String contentMarkdown) { this.contentMarkdown = contentMarkdown; }
 
-    public @Size(max = 64) String getCoverMediaKey() { return coverMediaKey; }
-    public void setCoverMediaKey(@Size(max = 64) String coverMediaKey) { this.coverMediaKey = coverMediaKey; }
+    public @Size(max = 512) String getCoverMediaKey() { return coverMediaKey; }
+    public void setCoverMediaKey(@Size(max = 512) String coverMediaKey) { this.coverMediaKey = coverMediaKey; }
 
     public @Size(max = 255) String getTechStack() { return techStack; }
     public void setTechStack(@Size(max = 255) String techStack) { this.techStack = techStack; }

OpenBlog-business/src/main/java/com/yqz/openblog/project/service/ProjectService.java

@@ -77,7 +77,7 @@ private void apply(Project p, ProjectUpsertRequest req) {
         p.setTitle(req.getTitle().trim());
         p.setSummary(req.getSummary() != null ? req.getSummary().trim() : null);
         p.setContentMarkdown(req.getContentMarkdown());
-        p.setCoverMediaKey(req.getCoverMediaKey() != null ? req.getCoverMediaKey().trim() : null);
+        p.setCoverMediaKey(normalizeCoverMediaKey(req.getCoverMediaKey()));
         p.setTechStack(req.getTechStack() != null ? req.getTechStack().trim() : null);
         p.setProjectUrl(req.getProjectUrl() != null ? req.getProjectUrl().trim() : null);
         p.setGithubUrl(req.getGithubUrl() != null ? req.getGithubUrl().trim() : null);
@@ -92,6 +92,31 @@ private void apply(Project p, ProjectUpsertRequest req) {
         }
     }
 
+    /**
+     * 封面图字段兼容两种输入：裸 media key（general/xxx.png）或完整媒体链接（https://…/api/v1/media/files/general/xxx.png）。
+     * 完整链接提取其中的 key 入库（DB 列仅 VARCHAR(64)，且前端 coverUrl() 会用 key 重新拼链接，不能存 URL）。
+     * 非法输入（非本站媒体、含 scheme/空白/路径穿越、超长）直接报错，避免静默丢数据。
+     */
+    private String normalizeCoverMediaKey(String raw) {
+        if (raw == null || raw.isBlank()) {
+            return null;
+        }
+        String v = raw.trim();
+        String marker = "/api/v1/media/files/";
+        int idx = v.indexOf(marker);
+        if (idx >= 0) {
+            v = v.substring(idx + marker.length());
+            int q = v.indexOf('?');
+            if (q >= 0) {
+                v = v.substring(0, q);
+            }
+        }
+        if (v.length() > 64 || v.contains(" ") || v.startsWith("http") || v.contains("..")) {
+            throw new BizException(4002, "封面图请填写媒体库 key（如 general/xxx.png）或本站媒体链接");
+        }
+        return v;
+    }
+
     private ProjectListItemResponse toListItem(Project p) {
         ProjectListItemResponse r = new ProjectListItemResponse();
         r.setId(p.getId());

vue/src/views/ConsoleProjectsView.vue

@@ -31,8 +31,9 @@
             <input v-model="form.summary" class="input" placeholder="一句话简介" maxlength="255" />
           </div>
           <div class="field">
-            <div class="label">封面图 Media Key</div>
-            <input v-model="form.coverMediaKey" class="input" placeholder="留空则不显示封面" />
+            <div class="label">封面图（媒体库 Key 或完整链接）</div>
+            <input v-model="form.coverMediaKey" class="input" placeholder="媒体库 key（如 general/xxx.png）或完整图片链接，留空不显示封面" />
+            <img v-if="form.coverMediaKey" :src="coverUrl(form.coverMediaKey)" alt="封面预览" class="cover-preview" />
           </div>
           <div class="field">
             <div class="label">技术栈</div>
@@ -110,7 +111,7 @@
 
 <script setup>
 import { onMounted, ref } from 'vue'
-import { fetchAdminProjects, fetchAdminProjectDetail, createProject, updateProject, deleteProject } from '../api/project'
+import { fetchAdminProjects, fetchAdminProjectDetail, createProject, updateProject, deleteProject, coverUrl } from '../api/project'
 import { showMessage } from '../utils/message'
 
 const loading = ref(true)
@@ -307,6 +308,16 @@ function formatDate(v) {
   overflow-y: auto;
 }
 
+.cover-preview {
+  display: block;
+  margin-top: 8px;
+  max-width: 100%;
+  max-height: 160px;
+  border-radius: 8px;
+  object-fit: cover;
+  border: 1px solid var(--console-border);
+}
+
 .console-editor-actions {
   display: flex;
   justify-content: flex-end;