fix: 修复 submit/retry/cancel 路由权限检查顺序（P1）

将权限检查从状态变更之后移到之前，防止非授权用户触发状态变更：
- submit_job: 先获取 job 并验证权限，再执行 SubmitJobUseCase
- retry_job: 同上
- cancel_job: 同上

修复审计 P1 问题。

apps/api/app/api/routes/jobs.py

@@ -130,6 +130,13 @@ def submit_job(
 
     将任务状态从 pending 切换为 running，并 dispatch Celery 异步任务。
     """
+    # 权限检查：先获取任务并验证权限，再执行状态变更
+    job = job_repo.get(job_id)
+    if job is None:
+        raise HTTPException(status_code=404, detail=f"Job {job_id} not found")
+    if job.created_by_user_id and job.created_by_user_id != authenticated_user.user.id:
+        raise HTTPException(status_code=403, detail="Access denied to this job")
+
     use_case = SubmitJobUseCase(job_repo)
 
     try:
@@ -137,10 +144,6 @@ def submit_job(
     except ValueError as e:
         raise HTTPException(status_code=400, detail=str(e))
 
-    # 权限检查
-    if job.created_by_user_id and job.created_by_user_id != authenticated_user.user.id:
-        raise HTTPException(status_code=403, detail="Access denied to this job")
-
     # Dispatch Celery 任务
     celery_task_name = _JOB_TYPE_TO_CELERY_TASK.get(job.job_type.value)
     if celery_task_name:
@@ -290,6 +293,13 @@ def retry_job(
     将任务重置为 pending，retry_count + 1，但不自动 dispatch。
     需要再次调用 /submit 提交执行。
     """
+    # 权限检查：先获取任务并验证权限，再执行状态变更
+    job = job_repo.get(job_id)
+    if job is None:
+        raise HTTPException(status_code=404, detail=f"Job {job_id} not found")
+    if job.created_by_user_id and job.created_by_user_id != authenticated_user.user.id:
+        raise HTTPException(status_code=403, detail="Access denied to this job")
+
     use_case = RetryJobUseCase(job_repo)
 
     try:
@@ -297,9 +307,6 @@ def retry_job(
     except ValueError as e:
         raise HTTPException(status_code=400, detail=str(e))
 
-    if job.created_by_user_id and job.created_by_user_id != authenticated_user.user.id:
-        raise HTTPException(status_code=403, detail="Access denied to this job")
-
     return job_to_response(job)
 
 
@@ -310,6 +317,13 @@ def cancel_job(
     job_repo: Any = Depends(get_job_repository),
 ) -> JobResponse:
     """取消任务。"""
+    # 权限检查：先获取任务并验证权限，再执行状态变更
+    job = job_repo.get(job_id)
+    if job is None:
+        raise HTTPException(status_code=404, detail=f"Job {job_id} not found")
+    if job.created_by_user_id and job.created_by_user_id != authenticated_user.user.id:
+        raise HTTPException(status_code=403, detail="Access denied to this job")
+
     use_case = CancelJobUseCase(job_repo)
 
     try:
@@ -317,7 +331,4 @@ def cancel_job(
     except ValueError as e:
         raise HTTPException(status_code=400, detail=str(e))
 
-    if job.created_by_user_id and job.created_by_user_id != authenticated_user.user.id:
-        raise HTTPException(status_code=403, detail="Access denied to this job")
-
     return job_to_response(job)