fix(worker/thumbnail): MediaKit 抽帧改用预签名 URL，避免私有 bucket 公网 URL 返回 403 导致抽帧降级 ffmpeg

apps/worker/video_processing/thumbnail_generator.py

@@ -221,7 +221,7 @@ def _extract_frames_via_mediakit(
     """
     import uuid
 
-    from video_processing.oss_helpers import upload_to_oss
+    from video_processing.oss_helpers import get_signed_download_url, upload_to_oss
 
     from packages.shared.mediakit_client import get_mediakit_client
 
@@ -230,14 +230,17 @@ def _extract_frames_via_mediakit(
         logger.info("[thumbnail] MediaKit 未配置，跳过智能抽帧")
         return None
 
-    # 1. 上传视频到 OSS 获取 URL
+    video_storage_key: str = ""
+    # 1. 上传视频到 OSS，并生成预签名下载 URL（bucket 私有读，公网 URL 会 403）
     try:
         video_storage_key = f"temp/{plan_id}/{uuid.uuid4().hex[:8]}_{Path(video_path).name}"
-        video_url = upload_to_oss(video_path, video_storage_key)
-        if not video_url:
+        public_url = upload_to_oss(video_path, video_storage_key)
+        if not public_url:
             logger.warning("[thumbnail] 视频上传 OSS 失败，无法使用 MediaKit")
             return None
-        logger.info("[thumbnail] 视频已上传 OSS: %s", video_url[:80])
+        # MediaKit 从公网拉取视频，必须使用预签名 URL；签名 1h 足够完成抽帧
+        video_url = get_signed_download_url(video_storage_key, expires_seconds=3600) or public_url
+        logger.info("[thumbnail] 视频已上传 OSS 并生成签名 URL: key=%s", video_storage_key[:80])
     except Exception as e:
         logger.warning("[thumbnail] 视频上传 OSS 异常: %s，降级到 ffmpeg", e)
         return None