feat: 完成原型04-10全链路功能开发，包括AI助手、PDF导出等

services/assistant-return.uts

@@ -0,0 +1,11 @@
+// 登录返回只允许助手路由与编号；拒绝任意returnUrl，重新登录后仍由服务端校验归属。
+export function assistantReturnPath(assessmentId: string, productIds: string, chatId: string, from: string): string {
+    const valid = (id: string): boolean => /^[1-9][0-9]{0,9}$/.test(id)
+    if ((assessmentId.length > 0 && !valid(assessmentId)) || (chatId.length > 0 && !valid(chatId))) return ''
+    const ids = productIds.length == 0 ? [] as string[] : productIds.split(',')
+    if (ids.length > 3 || (ids.length > 0 && assessmentId.length == 0)) return ''
+    const seen: string[] = []
+    for (let i = 0; i < ids.length; i++) { if (!valid(ids[i]) || seen.includes(ids[i])) return ''; seen.push(ids[i]) }
+    if (!['','matches','product','compare','report','next-step','archive'].includes(from)) return ''
+    return '/packages/finance/assistant/assistant?from=' + from + (assessmentId.length > 0 ? '&assessmentId=' + assessmentId + '&productIds=' + productIds : '') + (chatId.length > 0 ? '&chatId=' + chatId : '')
+}

services/next-step-route.uts

@@ -0,0 +1,6 @@
+// 登录回跳只接受固定页面和白名单参数，不接受外部 URL；页面仍需重新鉴权。
+export function nextStepRoute(assessmentId: string, productId: string = '', section: string = 'actions'): string {
+    const valid = (id: string): boolean => /^[1-9][0-9]{0,9}$/.test(id)
+    if (!valid(assessmentId) || (productId.length > 0 && !valid(productId)) || !['actions', 'prepare'].includes(section)) return ''
+    return '/packages/finance/next-step/next-step?assessmentId=' + assessmentId + (productId.length > 0 ? '&productId=' + productId : '') + '&section=' + section
+}

services/report-route.uts

@@ -0,0 +1,5 @@
+// 登录后只恢复本人报告的编号和栏目，不接受任意回跳URL。
+export function reportRoute(assessmentId: string, tab: string = 'overview'): string {
+    if (!/^[1-9][0-9]{0,9}$/.test(assessmentId) || !['overview', 'matches', 'improvements'].includes(tab)) return ''
+    return '/packages/finance/report/report?assessmentId=' + assessmentId + '&tab=' + tab
+}