feat(P1): 成片库按用户维度改造，修复一键生成查不到+越权漏洞

- generated_videos表加user_id列及索引
- 写表时透传user_id（edit_plan_generation + one_take生成）
- /videos接口默认按当前用户查，不传project_id不再查全表
- project_id降级为可选过滤条件
- 补单元测试覆盖user_id过滤逻辑

packages/adapters/sqlalchemy_impl/generated_video_repository.py

@@ -14,6 +14,7 @@ class SQLAlchemyGeneratedVideoRepository:
         model = GeneratedVideoModel(
             id=video.id,
             project_id=video.project_id,
+            user_id=video.user_id,
             generation_task_id=video.generation_task_id,
             name=video.name,
             file_url=video.file_url,
@@ -43,6 +44,7 @@ class SQLAlchemyGeneratedVideoRepository:
         return GeneratedVideo(
             id=model.id,
             project_id=model.project_id,
+            user_id=getattr(model, "user_id", ""),
             generation_task_id=model.generation_task_id,
             name=model.name,
             file_url=model.file_url,
@@ -103,15 +105,18 @@ class SQLAlchemyGeneratedVideoRepository:
     def list_paginated(
         self,
         *,
+        user_id: str | None = None,
         project_id: str | None = None,
         status: str | None = None,
         review_status: str | None = None,
         page: int = 1,
         page_size: int = 20,
     ) -> tuple[list[GeneratedVideo], int]:
-        """分页查询成片列表，支持按项目、状态、复核状态筛选。"""
+        """分页查询成片列表，支持按用户、项目、状态、复核状态筛选。"""
         query = self.session.query(GeneratedVideoModel)
 
+        if user_id:
+            query = query.filter(GeneratedVideoModel.user_id == user_id)
         if project_id:
             query = query.filter(GeneratedVideoModel.project_id == project_id)
         if status:
@@ -183,6 +188,7 @@ class SQLAlchemyGeneratedVideoRepository:
         return GeneratedVideo(
             id=model.id,
             project_id=model.project_id,
+            user_id=getattr(model, "user_id", ""),
             generation_task_id=model.generation_task_id,
             name=model.name,
             file_url=model.file_url,

packages/adapters/sqlalchemy_impl/models.py

@@ -282,6 +282,7 @@ class GeneratedVideoModel(Base):
 
     id = Column(String(36), primary_key=True)
     project_id = Column(String(36), nullable=False, index=True)
+    user_id = Column(String(36), nullable=False, default="", index=True)
     generation_task_id = Column(String(36), nullable=False, index=True)
     name = Column(String(255), nullable=False)
     # file_url: 完整可访问的 URL，用于客户端直接访问视频