fix: restore security hardening compatibility and validation

Restore authorized rule reveal, explicit full HTTP capture and retention, video task business fields, and valid payment URLs. Add opt-in credential preservation for trusted recovery, fix frontend type contracts and async races, and eliminate PostgreSQL test fixture resource leaks. Document audit coverage and successful fmt and CI-scoped Clippy checks.

frontend/src/api/client.ts

@@ -224,7 +224,7 @@ class ApiClient {
   /**
    * 处理响应错误
    */
-  private async handleResponseError(error: unknown): Promise<never> {
+  private async handleResponseError(error: unknown): Promise<AxiosResponse> {
     // 请求被取消
     if (axios.isCancel(error)) {
       return Promise.reject(error)