fix(acceptance): 允许受信模拟源的媒体物化

验收任务物化最终媒体时，仅允许访问 Acceptance Run 登记的协议模拟器精确 origin；其他私网、协议、端口及带 userinfo 的地址继续由 SSRF 防护拒绝。\n\n验证：Go 全量测试、go vet、gofmt 和 git diff --check 通过。

apps/api/internal/runner/upload_test.go

@@ -4,6 +4,8 @@ import (
 	"bytes"
 	"context"
 	"encoding/base64"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"strings"
@@ -301,6 +303,32 @@ func TestAcceptanceRunForcesURLMaterializationOnlyForAcceptanceTask(t *testing.T
 	}
 }
 
+func TestAcceptanceGeneratedMediaAllowsOnlyExactEmulatorOrigin(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "video/mp4")
+		_, _ = w.Write([]byte{0, 0, 0, 16, 'f', 't', 'y', 'p', 'i', 's', 'o', 'm'})
+	}))
+	defer server.Close()
+	service := &Service{}
+	asset := &generatedURLAsset{URL: server.URL + "/media/result.mp4", Kind: "video"}
+	payload, contentType, err := service.readGeneratedURLAsset(t.Context(), asset, server.URL+"/v1")
+	if err != nil {
+		t.Fatalf("read exact acceptance origin: %v", err)
+	}
+	if len(payload) != 12 || contentType != "video/mp4" {
+		t.Fatalf("payload=%d contentType=%q", len(payload), contentType)
+	}
+	for _, allowed := range []string{
+		strings.Replace(server.URL, "http://", "https://", 1),
+		server.URL + "1",
+		strings.Replace(server.URL, "http://", "http://user@", 1),
+	} {
+		if sameHTTPOrigin(asset.URL, allowed) {
+			t.Fatalf("unexpected origin match: %q", allowed)
+		}
+	}
+}
+
 func TestFinalizeGeneratedAssetsUploadsNestedInlineBinaryUnderDefaultPolicy(t *testing.T) {
 	storageDir := t.TempDir()
 	service := &Service{cfg: config.Config{LocalGeneratedStorageDir: storageDir}}