feat: 完善对象存储上传与真实条码二维码引擎，彻底剥离保底Mock数据

server/tests/upload.spec.ts

@@ -0,0 +1,33 @@
+import * as fs from 'fs';
+import * as path from 'path';
+
+describe('FileUpload Service (TDD 文件上传与静态对象存储服务门禁)', () => {
+  const rootDir = path.resolve(__dirname, '../..');
+  const serverIndexPath = path.join(rootDir, 'server/src/index.ts');
+  const uploadsDirPath = path.join(rootDir, 'server/public/uploads');
+
+  it('静态文件上传持久化目录 public/uploads 必须存在', () => {
+    expect(fs.existsSync(uploadsDirPath)).toBe(true);
+  });
+
+  it('server/src/index.ts 必须挂载 /uploads 静态托管路由与 /api/upload 接口', () => {
+    const content = fs.readFileSync(serverIndexPath, 'utf-8');
+    expect(content).toContain("app.use('/uploads', express.static(uploadDir));");
+    expect(content).toContain("app.post('/api/upload', handleFileUpload);");
+    expect(content).toContain("app.post('/api/user/upload', handleFileUpload);");
+  });
+
+  it('文件上传配置必须限制 10MB 与合法图片格式过滤', () => {
+    const content = fs.readFileSync(serverIndexPath, 'utf-8');
+    expect(content).toContain('10 * 1024 * 1024');
+    expect(content).toContain('image/jpeg');
+    expect(content).toContain('image/png');
+    expect(content).toContain('image/webp');
+  });
+
+  it('文件上传逻辑代码中必须严格遵循零 Emoji 门禁规范', () => {
+    const content = fs.readFileSync(serverIndexPath, 'utf-8');
+    const emojiRegex = /[\u{1F300}-\u{1F9FF}\u{2600}-\u{26FF}\u{2700}-\u{27BF}]/u;
+    expect(emojiRegex.test(content)).toBe(false);
+  });
+});