test(storage): 使用进程内 DNS 夹具消除离线测试依赖 (#689)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

backend/internal/assets/access_test.go

@@ -8,6 +8,7 @@ import (
 
 	"infinite-canvas/backend/internal/kernel"
 	"infinite-canvas/backend/internal/model"
+	"infinite-canvas/backend/internal/outbound/outboundtest"
 	"infinite-canvas/backend/internal/storage"
 )
 
@@ -26,6 +27,7 @@ func testPlatformURL(variants *[]ResourceVariant) func(ResourceVariant, time.Tim
 }
 
 func TestResolveAccessPolicyMatrix(t *testing.T) {
+	outboundtest.PublicDNS(t, "s3.amazonaws.com")
 	now := time.Date(2026, time.January, 2, 3, 4, 5, 0, time.UTC)
 	tests := []struct {
 		name       string
@@ -55,7 +57,7 @@ func TestResolveAccessPolicyMatrix(t *testing.T) {
 		{
 			name:     "CDN without supported auth falls back to public origin",
 			resource: testReadyResource("aliyun"),
-			setting:  storage.Settings{Provider: "aliyun", Endpoint: "https://s3.amazonaws.com", CDNBaseURL: "https://media.example.com", AccessKeyID: "id", AccessKeySecret: "secret"},
+			setting:  storage.Settings{Provider: "aliyun", Endpoint: "https://s3.amazonaws.com", Bucket: "private-bucket", CDNBaseURL: "https://media.example.com", AccessKeyID: "id", AccessKeySecret: "secret"},
 			options:  AccessOptions{Purpose: PurposeDisplay},
 			wantMode: DeliveryOrigin, wantReason: "cdn_auth_unconfigured",
 		},
@@ -98,6 +100,12 @@ func TestResolveAccessPolicyMatrix(t *testing.T) {
 			if access.Delivery != tt.wantMode || access.FallbackReason != tt.wantReason {
 				t.Fatalf("ResolveAccess() = %#v, want mode=%q reason=%q", access, tt.wantMode, tt.wantReason)
 			}
+			if tt.wantMode == DeliveryOrigin {
+				parsed, err := url.Parse(access.URL)
+				if err != nil || parsed.Host != "private-bucket.s3.amazonaws.com" || parsed.Query().Get("Signature") == "" {
+					t.Fatalf("invalid signed origin URL: %q (%v)", access.URL, err)
+				}
+			}
 			if tt.wantURL != "" && access.URL != tt.wantURL {
 				t.Fatalf("ResolveAccess().URL = %q, want %q", access.URL, tt.wantURL)
 			}