fix(api): 剪辑计划详情/列表接口rendered_url签名转换，修复OSS 403

#454 OSS 403收尾：
- generation status接口的video_url签名已在#467修复
- 本次修复plan详情/列表接口直接返回config的问题
- _to_response中对config.rendered_url自动做签名转换
- 覆盖GET /{plan_id}、列表、创建、更新、复制等所有返回EditPlanResponse的接口
- 新增3个单元测试，47个测试全过
- 失败降级：签名异常时返回原始URL，不阻塞主流程

tests/unit/test_edit_plans_api.py

@@ -487,6 +487,59 @@ class TestGetPlan:
         assert resp.status_code == 404
         assert "剪辑计划不存在" in resp.json()["detail"]
 
+    def test_get_plan_rendered_url_is_signed(self, client):
+        """plan详情接口返回的rendered_url应该是签名URL，不是裸OSS URL"""
+        c, repo = client
+        raw_url = "https://bucket.oss-cn-hangzhou.aliyuncs.com/rendered/plan-001/output.mp4"
+        signed_url = raw_url + "?OSSAccessKeyId=xxx&Expires=123456&Signature=yyy"
+        plan = EditPlan.create("tpl-001", "测试计划", config={"rendered_url": raw_url, "other": "val"})
+        plan.status = EditPlanStatus.COMPLETED
+        repo.create(plan)
+
+        mock_storage = MagicMock()
+        mock_storage.get_download_url.return_value = signed_url
+        with patch("app.api.routes.edit_plans.get_storage_service", return_value=mock_storage):
+            resp = c.get(f"/api/v1/edit-plans/{plan.id}")
+
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["config"]["rendered_url"] == signed_url
+        assert data["config"]["other"] == "val"
+        mock_storage.get_download_url.assert_called_once_with(raw_url, expires_seconds=86400)
+
+    def test_list_plans_rendered_url_is_signed(self, client):
+        """plan列表接口返回的rendered_url也应该是签名URL"""
+        c, repo = client
+        raw_url = "https://bucket.oss-cn-hangzhou.aliyuncs.com/rendered/plan-list/output.mp4"
+        signed_url = raw_url + "?OSSAccessKeyId=xxx&Expires=123456&Signature=yyy"
+        plan = EditPlan.create("tpl-001", "测试计划", config={"rendered_url": raw_url})
+        plan.status = EditPlanStatus.COMPLETED
+        repo.create(plan)
+
+        mock_storage = MagicMock()
+        mock_storage.get_download_url.return_value = signed_url
+        with patch("app.api.routes.edit_plans.get_storage_service", return_value=mock_storage):
+            resp = c.get("/api/v1/edit-plans")
+
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["items"][0]["config"]["rendered_url"] == signed_url
+
+    def test_get_plan_no_rendered_url_skips_signing(self, client):
+        """没有rendered_url的计划不调用签名服务"""
+        c, repo = client
+        plan = EditPlan.create("tpl-001", "测试计划", config={"key": "val"})
+        repo.create(plan)
+
+        mock_storage = MagicMock()
+        with patch("app.api.routes.edit_plans.get_storage_service", return_value=mock_storage):
+            resp = c.get(f"/api/v1/edit-plans/{plan.id}")
+
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["config"] == {"key": "val"}
+        mock_storage.get_download_url.assert_not_called()
+
 
 # ---------------------------------------------------------------------------
 # 更新测试