feat(P1): 成片库按用户维度改造，修复一键生成查不到+越权漏洞

- generated_videos表加user_id列及索引
- 写表时透传user_id（edit_plan_generation + one_take生成）
- /videos接口默认按当前用户查，不传project_id不再查全表
- project_id降级为可选过滤条件
- 补单元测试覆盖user_id过滤逻辑

tests/unit/test_generated_video_creation_logic.py

@@ -133,6 +133,7 @@ class TestVideoNameParameter:
         with pytest.raises(ValueError, match="name cannot be empty"):
             GeneratedVideo.create(
                 project_id="proj-1",
+                user_id="user-1",
                 generation_task_id="task-1",
                 name="",
                 file_url="https://example.com/test.mp4",
@@ -157,3 +158,131 @@ class TestVideoNameParameter:
         title_text = "我的旅行vlog"
         video_name_3 = title_text.strip() or f"generated-{generation_task_id[:8]}.mp4"
         assert video_name_3 == "我的旅行vlog"
+
+
+class TestUserIdFilter:
+    """验证成片库按 user_id 过滤的核心逻辑。"""
+
+    def _setup_repo(self):
+        from sqlalchemy import create_engine
+        from sqlalchemy.orm import sessionmaker
+
+        from packages.adapters.sqlalchemy_impl.generated_video_repository import (
+            SQLAlchemyGeneratedVideoRepository,
+        )
+        from packages.adapters.sqlalchemy_impl.models import Base
+
+        engine = create_engine("sqlite:///:memory:")
+        Base.metadata.create_all(engine)
+        session = sessionmaker(bind=engine)()
+        return SQLAlchemyGeneratedVideoRepository(session), session
+
+    def test_list_paginated_filters_by_user_id(self):
+        """list_paginated 传入 user_id 时只返回该用户的视频。"""
+        from packages.domain import GeneratedVideo
+
+        repo, session = self._setup_repo()
+        try:
+            # 用户A的2个视频
+            for i in range(2):
+                v = GeneratedVideo.create(
+                    project_id=f"proj-a-{i}",
+                    user_id="user-a",
+                    generation_task_id=f"task-a-{i}",
+                    name=f"video-a-{i}.mp4",
+                    file_url=f"https://oss.example.com/a-{i}.mp4",
+                )
+                repo.create(v)
+
+            # 用户B的3个视频
+            for i in range(3):
+                v = GeneratedVideo.create(
+                    project_id=f"proj-b-{i}",
+                    user_id="user-b",
+                    generation_task_id=f"task-b-{i}",
+                    name=f"video-b-{i}.mp4",
+                    file_url=f"https://oss.example.com/b-{i}.mp4",
+                )
+                repo.create(v)
+
+            # 查用户A → 2条
+            items, total = repo.list_paginated(user_id="user-a", page=1, page_size=10)
+            assert total == 2
+            assert len(items) == 2
+            assert all(it.user_id == "user-a" for it in items)
+
+            # 查用户B → 3条
+            items, total = repo.list_paginated(user_id="user-b", page=1, page_size=10)
+            assert total == 3
+            assert len(items) == 3
+            assert all(it.user_id == "user-b" for it in items)
+        finally:
+            session.close()
+
+    def test_list_paginated_user_id_plus_project_id(self):
+        """同时传 user_id 和 project_id 时两个条件同时过滤。"""
+        from packages.domain import GeneratedVideo
+
+        repo, session = self._setup_repo()
+        try:
+            # 用户A的proj-1视频
+            v1 = GeneratedVideo.create(
+                project_id="proj-1",
+                user_id="user-a",
+                generation_task_id="task-1",
+                name="v1.mp4",
+                file_url="https://oss.example.com/v1.mp4",
+            )
+            repo.create(v1)
+
+            # 用户B的proj-1视频（不同用户同项目）
+            v2 = GeneratedVideo.create(
+                project_id="proj-1",
+                user_id="user-b",
+                generation_task_id="task-2",
+                name="v2.mp4",
+                file_url="https://oss.example.com/v2.mp4",
+            )
+            repo.create(v2)
+
+            # 用户A + proj-1 → 只有1条
+            items, total = repo.list_paginated(user_id="user-a", project_id="proj-1", page=1, page_size=10)
+            assert total == 1
+            assert items[0].user_id == "user-a"
+            assert items[0].generation_task_id == "task-1"
+        finally:
+            session.close()
+
+    def test_generated_video_has_user_id_field(self):
+        """GeneratedVideo domain 对象有 user_id 字段。"""
+        from packages.domain import GeneratedVideo
+
+        v = GeneratedVideo.create(
+            project_id="proj-1",
+            user_id="user-123",
+            generation_task_id="task-1",
+            name="test.mp4",
+            file_url="https://example.com/test.mp4",
+        )
+        assert v.user_id == "user-123"
+
+    def test_created_video_persists_user_id(self):
+        """创建视频后 user_id 能正确持久化和读取。"""
+        from packages.domain import GeneratedVideo
+
+        repo, session = self._setup_repo()
+        try:
+            v = GeneratedVideo.create(
+                project_id="proj-1",
+                user_id="user-persist-test",
+                generation_task_id="task-persist",
+                name="persist.mp4",
+                file_url="https://example.com/persist.mp4",
+            )
+            repo.create(v)
+
+            fetched = repo.get(v.id)
+            assert fetched is not None
+            assert fetched.user_id == "user-persist-test"
+        finally:
+            session.close()