修复生成图片签名地址重复换签

将 refreshKey 调整为 signed URL 缓存版本号，同一路径同版本复用未过期签名地址。

让完整阿里云 OSS generated 地址在 hook 中先归一并走 read-url 换签。

补充前端回归测试，覆盖相同 refreshKey 不重复换签和完整 OSS 地址不裸写入图片。

更新运维文档与 Hermes 记忆，明确 refreshKey 不是每次绕过签名缓存。

src/hooks/useResolvedAssetReadUrl.test.tsx

@@ -116,6 +116,54 @@ describe('useResolvedAssetReadUrl', () => {
     );
   });
 
+  test('完整 OSS generated 地址也会先换签再写入 img', async () => {
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          ok: true,
+          data: {
+            read: {
+              objectKey:
+                'generated-puzzle-assets/puzzle-session-1/candidate-1/asset-1/image.png',
+              signedUrl: 'https://signed.example.com/puzzle.png',
+              expiresAt: '2099-01-01T00:10:00Z',
+            },
+          },
+          error: null,
+          meta: {
+            apiVersion: '2026-04-08',
+            routeVersion: '2026-04-08',
+            latencyMs: 1,
+            timestamp: '2099-01-01T00:00:00Z',
+          },
+        }),
+        {
+          status: 200,
+          headers: {
+            'Content-Type': 'application/json',
+          },
+        },
+      ),
+    );
+
+    render(
+      <ResolvedAssetImage
+        src="https://genarrative-release.oss-cn-beijing.aliyuncs.com/generated-puzzle-assets/puzzle-session-1/candidate-1/asset-1/image.png"
+        alt="候选图"
+      />,
+    );
+
+    expect(screen.queryByRole('img', { name: '候选图' })).toBeNull();
+
+    const image = await screen.findByRole('img', { name: '候选图' });
+    expect(image.getAttribute('src')).toBe(
+      'https://signed.example.com/puzzle.png',
+    );
+    expect(String(vi.mocked(globalThis.fetch).mock.calls[0]?.[0])).toContain(
+      'legacyPublicPath=%2Fgenerated-puzzle-assets%2Fpuzzle-session-1%2Fcandidate-1%2Fasset-1%2Fimage.png',
+    );
+  });
+
   test('refreshKey changes force a fresh signed url request without mutating OSS signature query', async () => {
     vi.spyOn(globalThis, 'fetch').mockImplementation(
       async () =>

src/hooks/useResolvedAssetReadUrl.ts

@@ -1,8 +1,8 @@
 import { useEffect, useState } from 'react';
 
 import {
-  isGeneratedLegacyPath,
   resolveAssetReadUrl,
+  shouldResolveAssetReadUrl,
 } from '../services/assetReadUrlService';
 
 type UseResolvedAssetReadUrlOptions = {
@@ -18,7 +18,7 @@ export function useResolvedAssetReadUrl(
   const enabled = options.enabled !== false;
   const normalizedSource = source?.trim() ?? '';
   const shouldResolve =
-    enabled && Boolean(normalizedSource) && isGeneratedLegacyPath(normalizedSource);
+    enabled && shouldResolveAssetReadUrl(normalizedSource);
   const [resolvedUrl, setResolvedUrl] = useState(
     shouldResolve ? '' : normalizedSource,
   );