feat: 完善创作工作台与用户诊断支持 (#295)

* feat(canvas): 参考素材 - 增加移除按钮并删除对应连线

* feat(canvas): 完善节点面板交互与拖拽反馈

* fix(canvas): 画布交互与小地图 - 统一浮层层级并完善节点识别

* feat(prompt-optimizer): 增加 AI 提示词优化器及宿主接入

* feat(canvas): 画布 - 增加自动整理节点按钮并补充文档

* chore(web): 前端 - 修正提示词优化器格式

* chore(backend): 后端 - 修正 Go 格式检查

* feat(workspace): 完善诊断导出与本地排障支持

* chore(web): 格式化诊断导出文件

* fix(web-test): 兼容 Bun 测试运行时

* fix(web-test): 对齐模型目录协议断言

backend/internal/handler/auth.go

@@ -783,7 +783,7 @@ func shortSystemProxyPath(rawPath string) (string, string, bool) {
 // as a channel request when a business route returns 404.
 func isReservedAPIPathPrefix(value string) bool {
 	switch strings.ToLower(strings.TrimSpace(value)) {
-	case "admin", "ai", "announcements", "assets", "auth", "canvas-projects", "channels", "features", "files", "model-catalog", "models", "oauth", "plugins", "projects", "protocols", "public", "resources", "sessions", "settings", "skills", "style-profiles", "tasks", "user-data", "voice-profiles", "wallet":
+	case "admin", "ai", "announcements", "assets", "auth", "canvas-projects", "channels", "diagnostics", "features", "files", "model-catalog", "models", "oauth", "plugins", "projects", "protocols", "public", "resources", "sessions", "settings", "skills", "style-profiles", "tasks", "user-data", "voice-profiles", "wallet":
 		return true
 	default:
 		return false

backend/internal/handler/diagnostics.go

@@ -0,0 +1,57 @@
+package handler
+
+import (
+	"fmt"
+	"net/http"
+
+	"infinite-canvas/backend/internal/service"
+
+	"github.com/gin-gonic/gin"
+)
+
+func RegisterDiagnosticsRoutes(r *gin.RouterGroup, svc *service.Service) {
+	r.POST("/diagnostics/preview", func(c *gin.Context) {
+		user, err := currentUser(c, svc)
+		if err != nil {
+			failService(c, err)
+			return
+		}
+		c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 4<<20)
+		var req service.DiagnosticExportRequest
+		if err := c.ShouldBindJSON(&req); err != nil {
+			fail(c, http.StatusBadRequest, err)
+			return
+		}
+		preview, err := svc.PreviewDiagnosticBundle(user.ID, req)
+		if err != nil {
+			failService(c, err)
+			return
+		}
+		ok(c, preview)
+	})
+
+	r.POST("/diagnostics/export", func(c *gin.Context) {
+		user, err := currentUser(c, svc)
+		if err != nil {
+			failService(c, err)
+			return
+		}
+		c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 4<<20)
+		var req service.DiagnosticExportRequest
+		if err := c.ShouldBindJSON(&req); err != nil {
+			fail(c, http.StatusBadRequest, err)
+			return
+		}
+		bundle, err := svc.ExportDiagnosticBundle(user.ID, req)
+		if err != nil {
+			failService(c, err)
+			return
+		}
+		c.Header("Cache-Control", "private, no-store")
+		c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=%q", bundle.FileName))
+		c.Header("X-Diagnostic-Bundle-ID", bundle.BundleID)
+		c.Header("X-Diagnostic-Schema-Version", "1")
+		c.Data(http.StatusOK, "application/zip", bundle.Data)
+	})
+
+}

backend/internal/handler/request-context.go

@@ -0,0 +1,70 @@
+package handler
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"regexp"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+const (
+	requestIDHeader = "X-Request-ID"
+	traceIDHeader   = "X-Canvas-Trace-ID"
+	requestIDKey    = "canvas.request_id"
+	traceIDKey      = "canvas.trace_id"
+)
+
+var correlationIDPattern = regexp.MustCompile(`^[A-Za-z0-9._:-]{1,96}$`)
+
+// RequestCorrelationMiddleware 为每个请求生成服务端 requestId，并保留一次业务操作的 traceId。
+// requestId 不能被客户端覆盖；traceId 只接受有限字符集，避免把任意请求头内容写入日志和诊断包。
+func RequestCorrelationMiddleware() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		requestID := newCorrelationID("req")
+		traceID := normalizeCorrelationID(c.GetHeader(traceIDHeader))
+		if traceID == "" {
+			traceID = newCorrelationID("trace")
+		}
+		c.Set(requestIDKey, requestID)
+		c.Set(traceIDKey, traceID)
+		c.Header(requestIDHeader, requestID)
+		c.Header(traceIDHeader, traceID)
+		c.Next()
+	}
+}
+
+func RequestID(c *gin.Context) string {
+	if value, ok := c.Get(requestIDKey); ok {
+		if result, ok := value.(string); ok {
+			return result
+		}
+	}
+	return ""
+}
+
+func TraceID(c *gin.Context) string {
+	if value, ok := c.Get(traceIDKey); ok {
+		if result, ok := value.(string); ok {
+			return result
+		}
+	}
+	return ""
+}
+
+func normalizeCorrelationID(value string) string {
+	value = strings.TrimSpace(value)
+	if !correlationIDPattern.MatchString(value) {
+		return ""
+	}
+	return value
+}
+
+func newCorrelationID(prefix string) string {
+	var raw [12]byte
+	if _, err := rand.Read(raw[:]); err != nil {
+		return prefix + "-unavailable"
+	}
+	return prefix + "-" + hex.EncodeToString(raw[:])
+}

backend/internal/handler/routes.go

@@ -43,6 +43,8 @@ func RegisterTaskRoutes(r *gin.RouterGroup, svc *service.Service) {
 			fail(c, http.StatusBadRequest, err)
 			return
 		}
+		req.TraceID = TraceID(c)
+		req.RequestID = RequestID(c)
 		task, err := svc.CreateTask(user.ID, req)
 		if err != nil {
 			fail(c, http.StatusBadRequest, err)
@@ -294,6 +296,8 @@ func RegisterSessionRoutes(r *gin.RouterGroup, svc *service.Service) {
 			fail(c, http.StatusBadRequest, err)
 			return
 		}
+		req.TraceID = TraceID(c)
+		req.RequestID = RequestID(c)
 		detail, err := svc.CreateSession(user.ID, req)
 		if err != nil {
 			fail(c, http.StatusBadRequest, err)

backend/internal/handler/system_proxy_path_test.go

@@ -12,6 +12,7 @@ func TestShortSystemProxyPath(t *testing.T) {
 		{path: "/api/channel-1/chat/completions", channel: "channel-1", provider: "/chat/completions", ok: true},
 		{path: "/api/channel-1/v1/models", channel: "channel-1", provider: "/v1/models", ok: true},
 		{path: "/api/tasks/123", ok: false},
+		{path: "/api/diagnostics/export", ok: false},
 		{path: "/api/channel-1", ok: false},
 		{path: "/api//chat/completions", ok: false},
 		{path: "/other/channel-1/chat/completions", ok: false},