fix: retry 端点增加归属校验 (P1 安全修复)

- generation_tasks.py: retry_generation_task 增加 created_by_user_id 校验
- task_center.py: retry_task_by_id 增加 created_by_user_id 校验
- 非任务创建者返回 403 Access denied

apps/api/app/api/routes/generation_tasks.py

@@ -216,7 +216,10 @@ def retry_generation_task(
     task = generation_task_repository.get(task_id)
     if task is None:
         raise HTTPException(status_code=404, detail="Generation task not found")
-    if task.status != "failed":
+    if task.created_by_user_id and task.created_by_user_id != authenticated_user.user.id:
+        raise HTTPException(status_code=403, detail="Access denied to this task")
+    status_val = task.status.value if hasattr(task.status, "value") else str(task.status)
+    if status_val != "failed":
         raise HTTPException(status_code=409, detail="Only failed tasks can be retried")
 
     use_case = CreateGenerationTaskUseCase(generation_task_repository)

apps/api/app/api/routes/task_center.py

@@ -134,6 +134,8 @@ def retry_task_by_id(
     task = generation_task_repository.get(task_id)
     if task is None:
         raise HTTPException(status_code=404, detail="Generation task not found")
+    if task.created_by_user_id and task.created_by_user_id != authenticated_user.user.id:
+        raise HTTPException(status_code=403, detail="Access denied to this task")
     if _status_value(task.status) != "failed":
         raise HTTPException(status_code=409, detail="Only failed tasks can be retried")