Merge master into dev/koko after patrol delete fixes

The merge keeps dev/koko patrol-delete asset fallback behavior while accepting the latest master feature work. Conflicts were limited to ignore rules, local environment/config artifacts, tracked pycache binaries, and the Flask main blueprint.

Constraint: master and dev/koko both edited app/blueprints/main.py around brand and asset serving

Rejected: Drop dev/koko asset fallback logic | patrol delete and rebuilt Vite assets still need hashed asset resolution across app/new_web_source locations

Confidence: medium

Scope-risk: broad

Directive: app/.env remains a tracked local-config file in this repository; do not print or normalize secrets during conflict handling

Tested: uv run python -m py_compile blueprints\\main.py amazon\\base.py amazon\\main.py

Tested: uv run --group dev pytest tests\\test_amazon_base.py tests\\test_patrol_delete.py

Not-tested: Full backend-java/frontend-vue test suites

app/blueprints/main.py

@@ -1,8 +1,8 @@
 """
 主页面蓝图：首页、home、图片工作台、品牌页、静态文件、Logo
 """
-import os
-from flask import Blueprint, send_file, render_template_string
+import os
+from flask import Blueprint, send_file, render_template_string
 
 from app_common import (
     get_db,
@@ -18,8 +18,8 @@ from flask import redirect, url_for, session
 from flask import Flask, request, Response, stream_with_context
 import requests
 
-from config import base_url,version,JAVA_API_BASE
-
+from config import base_url,version,JAVA_API_BASE
+
 main_bp = Blueprint('main', __name__)
 
 
@@ -130,9 +130,9 @@ def brand_page_legacy():
         '<header class="top-bar">',
         '<header class="top-bar" style="display:none !important;">',
         1,
-    )
-    content = content.replace('height: calc(100vh - 56px);', 'height: 100vh;', 1)
-    return render_template_string(content, user_id=session.get('user_id'))
+    )
+    content = content.replace('height: calc(100vh - 56px);', 'height: 100vh;', 1)
+    return render_template_string(content, user_id=session.get('user_id'))
 
 
 
@@ -147,7 +147,7 @@ def serve_static(filename):
         return '', 404
     return send_file(file_abs, as_attachment=False)
 
-
+
 @main_bp.route('/assets/<path:filename>')
 def serve_assets(filename):
     """提供 static 目录及子目录下的静态文件访问。"""
@@ -167,25 +167,18 @@ def serve_assets(filename):
     return '', 404
 
 
-@main_bp.route('/new_web_source/<path:filename>')
-def serve_new_web_source(filename):
-    """提供 new_web_source 目录下的静态页面文件访问。"""
-    candidate_dirs = [
-        os.path.abspath(os.path.join(BASE_DIR, 'new_web_source')),
-        os.path.abspath(os.path.join(BASE_DIR, '..', 'new_web_source')),
-    ]
-    for static_abs in candidate_dirs:
-        filepath = os.path.normpath(os.path.join(static_abs, filename))
-        file_abs = os.path.abspath(filepath)
-        if not file_abs.startswith(static_abs):
-            continue
-        if os.path.isfile(file_abs):
-            return send_file(file_abs, as_attachment=False)
-    return '', 404
-
-
-@main_bp.route('/logo.jpg', methods=['GET'])
-def get_logo_image():
+@main_bp.route('/new_web_source/<path:filename>')
+def serve_new_web_source(filename):
+    """提供 static 目录及子目录下的静态文件访问。"""
+    filepath = os.path.normpath(os.path.join("new_web_source", filename))
+    static_abs = os.path.abspath("new_web_source")
+    file_abs = os.path.abspath(filepath)
+    if not file_abs.startswith(static_abs) or not os.path.isfile(file_abs):
+        return '', 404
+    return send_file(file_abs, as_attachment=False)
+
+@main_bp.route('/logo.jpg', methods=['GET'])
+def get_logo_image():
     return send_file(os.path.join(BASE_DIR, "logo.jpg"), mimetype='image/jpeg')
 
 
@@ -253,4 +246,4 @@ def proxy(path):
         return Response("无法连接到后端服务", status=502)
     except Exception as e:
         print(f"代理请求失败: {e}")
-        return Response(f"代理错误: {str(e)}", status=500)
+        return Response(f"代理错误: {str(e)}", status=500)