perf(media): 生产媒体直传阿里云 OSS

生产同构验收确认 server_main_openapi 上传通道在媒体高并发下产生 381 个 502，并将已创建任务的 p95 拉高到 172 秒。\n\n为 request_asset 与 image_result 增加环境配置控制的阿里云 OSS 直传，保留普通上传原通道；使用 Kubernetes Secret 注入凭据，并对签名、重试、场景隔离和生产配置校验增加测试。\n\n验证：Go 全量测试、go vet、OpenAPI、迁移安全检查、Kustomize/Compose 渲染、gofmt 与 git diff --check 均通过；真实 OSS PUT/CDN 读取探针通过且对象已清理。

apps/api/internal/config/config_test.go

@@ -233,3 +233,37 @@ func TestValidateTaskHistorySettings(t *testing.T) {
 		t.Fatalf("Validate() error = %v, want invalid cleanup batch", err)
 	}
 }
+
+func TestLoadAndValidateDirectMediaOSS(t *testing.T) {
+	t.Setenv("APP_ENV", "production")
+	t.Setenv("AI_GATEWAY_MEDIA_OSS_DIRECT_ENABLED", "true")
+	t.Setenv("AI_GATEWAY_MEDIA_OSS_ENDPOINT", "https://media-bucket.oss-cn-shanghai.aliyuncs.com")
+	t.Setenv("AI_GATEWAY_MEDIA_OSS_BUCKET", "media-bucket")
+	t.Setenv("AI_GATEWAY_MEDIA_OSS_ACCESS_KEY_ID", "test-access-key")
+	t.Setenv("AI_GATEWAY_MEDIA_OSS_ACCESS_KEY_SECRET", "test-access-secret")
+	t.Setenv("AI_GATEWAY_MEDIA_OSS_PUBLIC_BASE_URL", "https://cdn.example.com")
+	t.Setenv("AI_GATEWAY_MEDIA_OSS_OBJECT_PREFIX", "easyai-ai-gateway/production/media")
+
+	cfg := Load()
+	if !cfg.MediaOSSDirectEnabled || cfg.MediaOSSBucket != "media-bucket" ||
+		cfg.MediaOSSObjectPrefix != "easyai-ai-gateway/production/media" {
+		t.Fatalf("unexpected direct media OSS config: %+v", cfg)
+	}
+	if err := cfg.Validate(); err != nil {
+		t.Fatalf("validate direct media OSS: %v", err)
+	}
+	cfg.MediaOSSAccessKeySecret = ""
+	if err := cfg.Validate(); err == nil || !strings.Contains(err.Error(), "ACCESS_KEY_SECRET") {
+		t.Fatalf("Validate() error = %v, want missing direct OSS secret", err)
+	}
+	cfg.MediaOSSAccessKeySecret = "test-access-secret"
+	cfg.MediaOSSEndpoint = "http://media-bucket.example.com"
+	if err := cfg.Validate(); err == nil || !strings.Contains(err.Error(), "HTTPS URL") {
+		t.Fatalf("Validate() error = %v, want insecure production endpoint", err)
+	}
+	cfg.MediaOSSEndpoint = "https://media-bucket.example.com"
+	cfg.MediaOSSObjectPrefix = "../outside"
+	if err := cfg.Validate(); err == nil || !strings.Contains(err.Error(), "OBJECT_PREFIX") {
+		t.Fatalf("Validate() error = %v, want invalid object prefix", err)
+	}
+}