feat(P1): 成片库按用户维度改造，修复一键生成查不到+越权漏洞

- generated_videos表加user_id列及索引
- 写表时透传user_id（edit_plan_generation + one_take生成）
- /videos接口默认按当前用户查，不传project_id不再查全表
- project_id降级为可选过滤条件
- 补单元测试覆盖user_id过滤逻辑

apps/api/app/api/routes/videos.py

@@ -57,7 +57,7 @@ def _to_video_response(item, storage: OSSStorageService | None = None) -> VideoI
 
 @router.get("/videos", response_model=ListVideosResponse)
 def list_videos(
-    project_id: str | None = Query(None, description="项目ID，不传则返回所有项目"),
+    project_id: str | None = Query(None, description="项目ID，可选过滤"),
     status: str | None = Query(None, description="按状态筛选"),
     review_status: str | None = Query(None, description="按复核状态筛选"),
     page: int = Query(1, ge=1, description="页码"),
@@ -66,9 +66,10 @@ def list_videos(
     storage: OSSStorageService = Depends(get_storage_service),
     current_user: AuthenticatedUser = Depends(get_current_user),
 ):
-    """成片列表，支持分页、按项目/状态/复核状态筛选。"""
+    """成片列表，默认返回当前用户的所有成片，支持按项目/状态/复核状态筛选。"""
     use_case = ListGeneratedVideosPaginatedUseCase(repo)
     items, total = use_case.execute(
+        user_id=current_user.user.id,
         project_id=project_id,
         status=status,
         review_status=review_status,

apps/worker/video_processing/dedup_helpers.py

@@ -18,6 +18,7 @@ def create_video_record_and_dedup(
     *,
     generation_task_id: str,
     project_id: str,
+    user_id: str = "",
     batch_id: str,
     file_url: str,
     file_size: int,
@@ -63,6 +64,7 @@ def create_video_record_and_dedup(
         generated_video = GeneratedVideo(
             id=video_id,
             project_id=project_id,
+            user_id=user_id,
             generation_task_id=generation_task_id,
             name=video_name,
             file_url=file_url,

apps/worker/worker_app/tasks/edit_plan_generation.py

@@ -150,6 +150,7 @@ def _finalize_render_success(
             create_video_record_and_dedup(
                 generation_task_id=generation_task_id,
                 project_id=project_id,
+                user_id=plan.created_by_user_id or "",
                 batch_id=batch_id,
                 file_url=output_url or "",
                 file_size=file_size,

apps/worker/worker_app/tasks/generation.py

@@ -1319,6 +1319,7 @@ def _upload_and_record(
     project_id: str,
     batch_id: str,
     editing_mode,
+    user_id: str = "",
 ) -> tuple[str, float, int, int]:
     """上传 OSS、创建视频记录并查重。
 
@@ -1366,6 +1367,7 @@ def _upload_and_record(
         video_count = create_video_record_and_dedup(
             generation_task_id=task_id,
             project_id=project_id,
+            user_id=user_id,
             batch_id=batch_id,
             file_url=file_url,
             file_size=file_size,
@@ -1511,6 +1513,7 @@ def generate_video(self, task_id: str) -> dict:
                 project_id=project_id,
                 batch_id=batch_id,
                 editing_mode=editing_mode,
+                user_id=user_id,
             )
 
             if gen_task: