fix(media): 统一图片结果 URL 化并限制同步 Base64

将上游 URL 直接持久化，内联媒体经对象存储后仅保留 URL 与内部定位元数据；异步轮询、任务详情和幂等重放统一使用零对象读取的 URL 投影，并增加 64KiB 响应门禁。

OpenAI 图片接口接受 url 与 b64_json，同步 Base64 限制为 20MiB 和每 Pod 2 并发；新增历史结果迁移清零门禁、结果指标和 API GOMEMLIMIT。

验证：API go test ./...、go vet、聚焦 race、pnpm openapi、pnpm lint/test/build、迁移安全检查与 docker compose config 均通过。

apps/api/internal/httpapi/public_errors_test.go

@@ -66,7 +66,7 @@ func TestPublicHTTPErrorIncludesSafeUpstreamParameterMessage(t *testing.T) {
 	}
 }
 
-func TestPublicGatewayTaskSanitizesCopyAndKeepsRawAuditFields(t *testing.T) {
+func TestPublicGatewayTaskSanitizesCopyAndKeepsRawAuditFieldsInternal(t *testing.T) {
 	rawMessage := `404 page not found: {"privateProject":"secret"}`
 	task := store.GatewayTask{
 		ID:           "task-1",
@@ -74,11 +74,13 @@ func TestPublicGatewayTaskSanitizesCopyAndKeepsRawAuditFields(t *testing.T) {
 		ErrorCode:    "http_404",
 		ErrorMessage: rawMessage,
 		Attempts: []store.TaskAttempt{{
-			AttemptNo:    1,
-			Status:       "failed",
-			StatusCode:   http.StatusNotFound,
-			ErrorCode:    "http_404",
-			ErrorMessage: rawMessage,
+			AttemptNo:        1,
+			Status:           "failed",
+			StatusCode:       http.StatusNotFound,
+			ErrorCode:        "http_404",
+			ErrorMessage:     rawMessage,
+			RequestSnapshot:  map[string]any{"image_base64": "private-input"},
+			ResponseSnapshot: map[string]any{"provider_payload": "private-output"},
 		}},
 	}
 
@@ -89,9 +91,15 @@ func TestPublicGatewayTaskSanitizesCopyAndKeepsRawAuditFields(t *testing.T) {
 	if strings.Contains(public.ErrorMessage, "secret") || public.Attempts[0].ErrorMessage == rawMessage {
 		t.Fatalf("public task leaked upstream details: %+v", public)
 	}
+	if public.Attempts[0].RequestSnapshot != nil || public.Attempts[0].ResponseSnapshot != nil {
+		t.Fatalf("public task leaked attempt snapshots: %+v", public.Attempts[0])
+	}
 	if task.ErrorCode != "http_404" || task.ErrorMessage != rawMessage || task.Attempts[0].ErrorCode != "http_404" || task.Attempts[0].ErrorMessage != rawMessage {
 		t.Fatalf("public conversion mutated raw audit fields: %+v", task)
 	}
+	if task.Attempts[0].RequestSnapshot == nil || task.Attempts[0].ResponseSnapshot == nil {
+		t.Fatalf("public conversion mutated internal snapshots: %+v", task.Attempts[0])
+	}
 }
 
 func TestPublicGatewayTaskForwardsSafeUpstreamParameterMessage(t *testing.T) {