refactor(api-server): narrow puzzle state surface

server-rs/crates/api-server/src/modules/puzzle.rs

@@ -1,6 +1,6 @@
 use axum::{
     Router,
-    extract::DefaultBodyLimit,
+    extract::{DefaultBodyLimit, FromRef},
     middleware,
     routing::{get, post},
 };
@@ -17,12 +17,13 @@ use crate::{
         submit_puzzle_agent_message, submit_puzzle_leaderboard, swap_puzzle_pieces,
         update_puzzle_run_pause, use_puzzle_runtime_prop,
     },
-    state::AppState,
+    state::{AppState, PuzzleApiState},
 };
 
 const PUZZLE_REFERENCE_IMAGE_BODY_LIMIT_BYTES: usize = 12 * 1024 * 1024;
 
 pub fn router(state: AppState) -> Router<AppState> {
+    // 中文注释：拼图 handler 只接收 PuzzleApiState，鉴权层仍使用全局 AppState。
     Router::new()
         .route(
             "/api/runtime/puzzle/agent/sessions",
@@ -181,4 +182,6 @@ pub fn router(state: AppState) -> Router<AppState> {
                 require_bearer_auth,
             )),
         )
+        .with_state(PuzzleApiState::from_ref(&state))
+        .with_state(state)
 }