fix: restore security hardening compatibility and validation

Restore authorized rule reveal, explicit full HTTP capture and retention, video task business fields, and valid payment URLs. Add opt-in credential preservation for trusted recovery, fix frontend type contracts and async races, and eliminate PostgreSQL test fixture resource leaks. Document audit coverage and successful fmt and CI-scoped Clippy checks.

frontend/src/features/usage/composables/useUsageData.ts

@@ -160,7 +160,7 @@ export function useUsageData(options: UseUsageDataOptions) {
           }
 
           // statsData may contain additional fields not declared in UsageStats
-          const statsRaw = statsData as Record<string, unknown>
+          const statsRaw = statsData
           stats.value = {
             total_requests: statsData.total_requests || 0,
             total_tokens: statsData.total_tokens || 0,
@@ -187,7 +187,7 @@ export function useUsageData(options: UseUsageDataOptions) {
           }
 
           modelStats.value = modelData.map(item => {
-            const raw = item as Record<string, unknown>
+            const raw = item
             return {
               model: item.model,
               request_count: item.request_count || 0,
@@ -422,7 +422,7 @@ export function useUsageData(options: UseUsageDataOptions) {
         if (requestId !== loadRecordsRequestId) {
           return
         }
-        const nextRecords = (response.records || []) as UsageRecord[]
+        const nextRecords = (response.records || [])
         currentRecords.value = mergeRecordStatus(currentRecords.value, nextRecords)
         const totalKey = buildAdminRecordTotalKey(params)
         applyAdminRecordTotal(totalKey, response.total ?? 0, response.total_is_estimated === true)
@@ -524,8 +524,8 @@ export function useUsageData(options: UseUsageDataOptions) {
       // 确定是否需要保护 status（避免刷新把已知状态覆盖为 undefined 或回退）
       const hasExistingStatus = typeof existing.status === 'string' && existing.status.length > 0
       const hasNextStatus = typeof record.status === 'string' && record.status.length > 0
-      const currentRank = hasExistingStatus ? (statusPriority[existing.status] ?? -1) : -1
-      const nextRank = hasNextStatus ? (statusPriority[record.status] ?? -1) : -1
+      const currentRank = hasExistingStatus ? (statusPriority[existing.status ?? ''] ?? -1) : -1
+      const nextRank = hasNextStatus ? (statusPriority[record.status ?? ''] ?? -1) : -1
       const existingUpdatedAtMs = parseUsageTimestampMs(existing.updated_at)
       const nextUpdatedAtMs = parseUsageTimestampMs(record.updated_at)
       const nextStatusSnapshotIsStale = existingUpdatedAtMs != null &&