feat(collaboration): 完善在线文档协作与通知闭环

- 新增协作文件夹、文件、不可变修订、成员、会话、回调回执、编辑申请与分享链接数据模型。

- 补齐新建、导入、复制、下载、回收站、恢复、成员授权、所有权转让及文件级权限接口。

- 接入 ONLYOFFICE 共同编辑、历史版本预览与恢复、修订另存副本、导出下载审计和幂等回调保存。

- 增加编辑权限申请、审批通知、项目提醒聚合、通知 Feed、已读处理及历史待办数据回填。

- 支持公开分享的查看或编辑模式、有效期、密码哈希、失败锁定、短时访问凭证与固定分享地址。

- 增加协作者导出、申请编辑、工作表结构保护和所有权管理策略，并纳入项目接口权限矩阵。

- 新增协作文件库、编辑工作区、公开分享页、下载与另存为对话框，以及导航、路由和权限入口。

- 统一网页端与桌面端通知布局，增加沉浸式工作区和浏览器、Tauri 双端全屏能力。

- 扩展运行时文件下载适配、Tauri 环境识别和原生全屏命令，继续保持业务代码运行时边界。

- 加固 ONLYOFFICE 消息桥的同源下载、签名地址隔离和保存为能力校验，并更新桌面发布检查。

- 增加连续数据库迁移、50MB 上传限制、OnlyOffice 中文文案与开发启动路由校验。

- 补充协作、通知、权限、路由、运行时、布局和 OnlyOffice 相关测试及模块说明文档。

frontend/public/onlyoffice-host.js

@@ -7,8 +7,15 @@
     DOCUMENT_READY: "ctms.onlyoffice.document-ready",
     WARNING: "ctms.onlyoffice.warning",
     ERROR: "ctms.onlyoffice.error",
+    DOCUMENT_STATE_CHANGE: "ctms.onlyoffice.document-state-change",
+    SAVE_AS: "ctms.onlyoffice.save-as",
+    SAVE_AS_ERROR: "ctms.onlyoffice.save-as-error",
+    DOWNLOAD: "ctms.onlyoffice.download",
+    DOWNLOAD_ERROR: "ctms.onlyoffice.download-error",
+    REQUEST_EDIT_RIGHTS: "ctms.onlyoffice.request-edit-rights",
   });
   const API_SCRIPT_PATH = "/onlyoffice/web-apps/apps/api/documents/api.js";
+  const MAX_SAVE_AS_BYTES = 64 * 1024 * 1024;
   const ALLOWED_TAURI_ORIGINS = new Set([
     "tauri://localhost",
     "http://tauri.localhost",
@@ -21,6 +28,7 @@
   let apiScriptPromise = null;
   let readyTimer = null;
   let readyDeadlineTimer = null;
+  let documentTitle = "download";
 
   const isLoopbackOrigin = (origin) => {
     try {
@@ -34,9 +42,9 @@
   const isAllowedParentOrigin = (origin) =>
     origin === window.location.origin || ALLOWED_TAURI_ORIGINS.has(origin) || isLoopbackOrigin(origin);
 
-  const postToParent = (type, detail) => {
+  const postToParent = (type, detail, transfer = []) => {
     if (!parentOrigin || !requestNonce) return;
-    window.parent.postMessage({ type, nonce: requestNonce, detail }, parentOrigin);
+    window.parent.postMessage({ type, nonce: requestNonce, detail }, parentOrigin, transfer);
   };
 
   const safeEventDetail = (event) => {
@@ -67,6 +75,83 @@
     return apiScriptPromise;
   };
 
+  const saveAsEventDetail = (event) => {
+    const raw = event && typeof event === "object" && "data" in event ? event.data : null;
+    if (!raw || typeof raw !== "object") throw new Error("另存为数据格式不正确");
+    const fileType = typeof raw.fileType === "string" ? raw.fileType.toLowerCase() : "";
+    const title = typeof raw.title === "string" ? raw.title.trim().slice(0, 240) : "";
+    if (!/^[a-z0-9]{1,16}$/.test(fileType) || !title || typeof raw.url !== "string") {
+      throw new Error("另存为文件信息不完整");
+    }
+    const url = new URL(raw.url, window.location.origin);
+    if (url.origin !== window.location.origin || !url.pathname.startsWith("/onlyoffice/")) {
+      throw new Error("另存为文件地址不可信");
+    }
+    return { fileType, title, url };
+  };
+
+  const handleRequestSaveAs = async (event) => {
+    try {
+      const { fileType, title, url } = saveAsEventDetail(event);
+      const response = await fetch(url, {
+        cache: "no-store",
+        credentials: "omit",
+        redirect: "error",
+      });
+      if (!response.ok) throw new Error("另存为文件生成失败");
+      const declaredSize = Number(response.headers.get("content-length") || "0");
+      if (declaredSize > MAX_SAVE_AS_BYTES) throw new Error("另存为文件超出大小限制");
+      const data = await response.arrayBuffer();
+      if (!data.byteLength || data.byteLength > MAX_SAVE_AS_BYTES) throw new Error("另存为文件内容无效");
+      const mimeType = (response.headers.get("content-type") || "application/octet-stream").slice(0, 120);
+      postToParent(MESSAGE.SAVE_AS, { fileType, title, mimeType, data }, [data]);
+    } catch (error) {
+      postToParent(MESSAGE.SAVE_AS_ERROR, {
+        message: error instanceof Error ? error.message.slice(0, 200) : "另存为失败",
+      });
+    }
+  };
+
+  const downloadEventDetail = (event) => {
+    const raw = event && typeof event === "object" && "data" in event ? event.data : null;
+    if (!raw || typeof raw !== "object") throw new Error("下载文件数据格式不正确");
+    const fileType = typeof raw.fileType === "string" ? raw.fileType.toLowerCase() : "";
+    if (!/^[a-z0-9]{1,16}$/.test(fileType) || typeof raw.url !== "string") {
+      throw new Error("下载文件信息不完整");
+    }
+    const url = new URL(raw.url, window.location.origin);
+    if (url.origin !== window.location.origin || !url.pathname.startsWith("/onlyoffice/")) {
+      throw new Error("下载文件地址不可信");
+    }
+    const suffix = `.${fileType}`;
+    const stem = documentTitle.toLowerCase().endsWith(suffix)
+      ? documentTitle.slice(0, -suffix.length)
+      : documentTitle.replace(/\.[^.]+$/, "");
+    return { fileType, title: `${stem}${suffix}`, url };
+  };
+
+  const handleDownloadAs = async (event) => {
+    try {
+      const { fileType, title, url } = downloadEventDetail(event);
+      const response = await fetch(url, {
+        cache: "no-store",
+        credentials: "omit",
+        redirect: "error",
+      });
+      if (!response.ok) throw new Error("下载文件生成失败");
+      const declaredSize = Number(response.headers.get("content-length") || "0");
+      if (declaredSize > MAX_SAVE_AS_BYTES) throw new Error("下载文件超出大小限制");
+      const data = await response.arrayBuffer();
+      if (!data.byteLength || data.byteLength > MAX_SAVE_AS_BYTES) throw new Error("下载文件内容无效");
+      const mimeType = (response.headers.get("content-type") || "application/octet-stream").slice(0, 120);
+      postToParent(MESSAGE.DOWNLOAD, { fileType, title, mimeType, data }, [data]);
+    } catch (error) {
+      postToParent(MESSAGE.DOWNLOAD_ERROR, {
+        message: error instanceof Error ? error.message.slice(0, 200) : "下载失败",
+      });
+    }
+  };
+
   const destroyEditor = () => {
     if (editor && typeof editor.destroyEditor === "function") {
       try {
@@ -95,14 +180,24 @@
       throw new Error("预览配置格式不正确");
     }
     requestNonce = message.nonce;
+    documentTitle = typeof config.document?.title === "string" && config.document.title.trim()
+      ? config.document.title.trim().slice(0, 240)
+      : "download";
     await loadOnlyOfficeApi();
+    const events = {
+      onDocumentReady: () => postToParent(MESSAGE.DOCUMENT_READY),
+      onWarning: (event) => postToParent(MESSAGE.WARNING, safeEventDetail(event)),
+      onError: (event) => postToParent(MESSAGE.ERROR, safeEventDetail(event)),
+      onDocumentStateChange: (event) => postToParent(MESSAGE.DOCUMENT_STATE_CHANGE, {
+        changed: Boolean(event && typeof event === "object" && "data" in event ? event.data : event),
+      }),
+      onRequestEditRights: () => postToParent(MESSAGE.REQUEST_EDIT_RIGHTS),
+    };
+    if (message?.allowSaveAs === true) events.onRequestSaveAs = handleRequestSaveAs;
+    if (message?.allowDownload === true) events.onDownloadAs = handleDownloadAs;
     const editorConfig = {
       ...config,
-      events: {
-        onDocumentReady: () => postToParent(MESSAGE.DOCUMENT_READY),
-        onWarning: (event) => postToParent(MESSAGE.WARNING, safeEventDetail(event)),
-        onError: (event) => postToParent(MESSAGE.ERROR, safeEventDetail(event)),
-      },
+      events,
     };
     editor = new window.DocsAPI.DocEditor("onlyoffice-editor", editorConfig);
   };