perf(storage): 拦截任务二进制并本地暂存结果

原因：任务标准结果中的 Base64、Data URI 和 Buffer 会进入 PostgreSQL JSON，导致 TOAST 与备份体积快速增长。

影响：新增统一 JSON 持久化关口；upload_none 将二进制原子写入本地结果目录，数据库仅保存带 SHA-256 的有界占位符；任务详情、同步响应、异步查询和兼容协议按需校验恢复。补充 24 小时清理、容量上限、历史小批量治理命令及管理端说明。

风险：本地结果超过 TTL、丢失或损坏时分别返回明确的 410/500；空间不足时返回 503 且不重试上游。未自动执行历史治理。

验证：三种真实图片模型同步/异步与幂等重放通过；Go vet/全量测试、前端 111 测试、lint/typecheck/build、OpenAPI、迁移安全、govulncheck、依赖审计、手工发布测试及 Linux amd64 构建通过。

apps/api/internal/httpapi/kling_compat.go

@@ -144,6 +144,8 @@ func (s *Server) createKlingCompatTask(w http.ResponseWriter, r *http.Request, v
 			writeKlingCompatError(w, http.StatusConflict, err.Error(), "idempotency_key_reused")
 		case errors.Is(err, store.ErrExternalTaskIDReused):
 			writeKlingCompatError(w, http.StatusConflict, err.Error(), "external_task_id_reused")
+		case errors.Is(err, store.ErrTaskRequestBinaryNotMaterialized):
+			writeKlingCompatError(w, http.StatusBadRequest, err.Error(), clients.ErrorCode(err))
 		default:
 			s.logger.Error("create Kling compatibility task failed", "version", version, "model", model, "error", err)
 			writeKlingCompatError(w, http.StatusInternalServerError, "create task failed", "task_create_failed")
@@ -464,6 +466,7 @@ func validateKlingCompatBody(model string, body map[string]any) error {
 // @Param taskID path string true "任务 ID"
 // @Success 200 {object} map[string]interface{}
 // @Failure 404 {object} map[string]interface{}
+// @Failure 410 {object} map[string]interface{}
 // @Router /api/v1/kling/v1/videos/omni-video/{taskID} [get]
 func (s *Server) klingV1GetOmniVideo(w http.ResponseWriter, r *http.Request) {
 	user, _ := auth.UserFromContext(r.Context())
@@ -476,6 +479,11 @@ func (s *Server) klingV1GetOmniVideo(w http.ResponseWriter, r *http.Request) {
 		writeKlingCompatError(w, http.StatusInternalServerError, "get task failed", "task_query_failed")
 		return
 	}
+	task, err = s.hydrateTaskResult(r.Context(), task)
+	if err != nil {
+		writeKlingCompatError(w, statusFromRunError(err), err.Error(), clients.ErrorCode(err))
+		return
+	}
 	writeJSON(w, http.StatusOK, klingV1Envelope(task))
 }
 
@@ -520,6 +528,7 @@ func (s *Server) klingV1ListOmniVideos(w http.ResponseWriter, r *http.Request) {
 // @Param task_ids query string false "逗号分隔的任务 ID"
 // @Param external_task_ids query string false "逗号分隔的外部任务 ID"
 // @Success 200 {object} map[string]interface{}
+// @Failure 410 {object} map[string]interface{}
 // @Router /api/v1/kling/v2/tasks [get]
 func (s *Server) klingV2GetTasks(w http.ResponseWriter, r *http.Request) {
 	user, _ := auth.UserFromContext(r.Context())
@@ -543,6 +552,11 @@ func (s *Server) klingV2GetTasks(w http.ResponseWriter, r *http.Request) {
 			writeKlingCompatError(w, http.StatusInternalServerError, "get task failed", "task_query_failed")
 			return
 		}
+		task, err = s.hydrateTaskResult(r.Context(), task)
+		if err != nil {
+			writeKlingCompatError(w, statusFromRunError(err), err.Error(), clients.ErrorCode(err))
+			return
+		}
 		data = append(data, klingV2TaskData(task))
 	}
 	writeJSON(w, http.StatusOK, map[string]any{"code": 0, "message": "success", "request_id": klingRequestIDFromAny(data), "data": data})