feat: 新增文件上传支持，优化移动端UI与巡检功能

1.  新增全局上传配置，设置默认20MB请求体上限与上传目录
2.  重构上传文件处理，按天自动创建子目录存储文件
3.  修复巡检上传表单移动端强制调用相机的问题
4.  为MES与库房客户端添加响应式侧边栏，支持桌面折叠与移动端抽屉模式
5.  补充PAD端巡检页面的独立访问说明文档
6.  删除冗余的前端静态首页文件
7.  更新库房客户端静态资源哈希值

bj_power_mes/internal/handler/inspection.go

@@ -53,7 +53,7 @@ func ListInspectionsHandler(svcCtx *svc.ServiceContext) http.HandlerFunc {
 // UploadPhotoHandler POST /inspections/upload（巡检拍照上传，返回文件名）
 func UploadPhotoHandler(svcCtx *svc.ServiceContext) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		if err := r.ParseMultipartForm(32 << 20); err != nil {
+		if err := r.ParseMultipartForm(svcCtx.Config.Upload.MaxMB << 20); err != nil {
 			httpx.BadRequest(w, "上传文件过大或格式错误")
 			return
 		}

bj_power_mes/internal/handler/upload.go

@@ -11,9 +11,11 @@ import (
 	"time"
 )
 
-// saveUploadFile 保存上传文件（工艺图纸PDF / 巡检照片），返回生成的文件名
+// saveUploadFile 保存上传文件（工艺图纸PDF / 巡检照片），返回生成的相对文件名（含日期子目录）
 func saveUploadFile(r *http.Request, field, dir string) (string, error) {
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	sub := time.Now().Format("2006-01-02")
+	full := filepath.Join(dir, sub)
+	if err := os.MkdirAll(full, 0o755); err != nil {
 		return "", err
 	}
 	file, header, err := r.FormFile(field)
@@ -27,7 +29,7 @@ func saveUploadFile(r *http.Request, field, dir string) (string, error) {
 		ext = ".bin"
 	}
 	name := time.Now().Format("20060102150405") + "_" + randHex(6) + ext
-	dst, err := os.Create(filepath.Join(dir, name))
+	dst, err := os.Create(filepath.Join(full, name))
 	if err != nil {
 		return "", err
 	}
@@ -35,7 +37,7 @@ func saveUploadFile(r *http.Request, field, dir string) (string, error) {
 	if _, err := io.Copy(dst, file); err != nil {
 		return "", err
 	}
-	return name, nil
+	return filepath.ToSlash(filepath.Join(sub, name)), nil
 }
 
 func randHex(n int) string {
@@ -44,26 +46,30 @@ func randHex(n int) string {
 	return hex.EncodeToString(b)[:n*2]
 }
 
-// serveUploadFile 下发上传目录中的文件（限制为单段文件名，防路径穿越）
+// serveUploadFile 下发上传目录中的文件（仅允许 单层日期子目录/文件名，防路径穿越）
 func serveUploadFile(w http.ResponseWriter, r *http.Request, dir, name string) {
-	name = strings.TrimSpace(filepath.Base(name))
-	if name == "" || name == "." || name == ".." || strings.Contains(name, "..") {
+	name = strings.TrimSpace(name)
+	clean := filepath.Clean(filepath.FromSlash(name))
+	if clean == "." || clean == ".." ||
+		strings.HasPrefix(clean, ".."+string(filepath.Separator)) ||
+		filepath.IsAbs(clean) || strings.ContainsRune(name, '\x00') {
 		http.Error(w, "非法文件名", http.StatusBadRequest)
 		return
 	}
-	f, err := os.Open(filepath.Join(dir, name))
+	f, err := os.Open(filepath.Join(dir, clean))
 	if err != nil {
 		http.Error(w, "文件不存在", http.StatusNotFound)
 		return
 	}
 	defer f.Close()
 	ct := "application/octet-stream"
+	base := strings.ToLower(clean)
 	switch {
-	case strings.HasSuffix(strings.ToLower(name), ".pdf"):
+	case strings.HasSuffix(base, ".pdf"):
 		ct = "application/pdf"
-	case strings.HasSuffix(strings.ToLower(name), ".jpg"), strings.HasSuffix(strings.ToLower(name), ".jpeg"):
+	case strings.HasSuffix(base, ".jpg"), strings.HasSuffix(base, ".jpeg"):
 		ct = "image/jpeg"
-	case strings.HasSuffix(strings.ToLower(name), ".png"):
+	case strings.HasSuffix(base, ".png"):
 		ct = "image/png"
 	}
 	w.Header().Set("Content-Type", ct)