feat(collaboration): 完善在线文档协作与通知闭环

- 新增协作文件夹、文件、不可变修订、成员、会话、回调回执、编辑申请与分享链接数据模型。

- 补齐新建、导入、复制、下载、回收站、恢复、成员授权、所有权转让及文件级权限接口。

- 接入 ONLYOFFICE 共同编辑、历史版本预览与恢复、修订另存副本、导出下载审计和幂等回调保存。

- 增加编辑权限申请、审批通知、项目提醒聚合、通知 Feed、已读处理及历史待办数据回填。

- 支持公开分享的查看或编辑模式、有效期、密码哈希、失败锁定、短时访问凭证与固定分享地址。

- 增加协作者导出、申请编辑、工作表结构保护和所有权管理策略，并纳入项目接口权限矩阵。

- 新增协作文件库、编辑工作区、公开分享页、下载与另存为对话框，以及导航、路由和权限入口。

- 统一网页端与桌面端通知布局，增加沉浸式工作区和浏览器、Tauri 双端全屏能力。

- 扩展运行时文件下载适配、Tauri 环境识别和原生全屏命令，继续保持业务代码运行时边界。

- 加固 ONLYOFFICE 消息桥的同源下载、签名地址隔离和保存为能力校验，并更新桌面发布检查。

- 增加连续数据库迁移、50MB 上传限制、OnlyOffice 中文文案与开发启动路由校验。

- 补充协作、通知、权限、路由、运行时、布局和 OnlyOffice 相关测试及模块说明文档。

frontend/scripts/verify-desktop-release.mjs

@@ -206,6 +206,11 @@ const verifyOnlyOfficeBoundary = async () => {
   assert(hostSource.includes("!isAllowedParentOrigin(event.origin)"), "ONLYOFFICE host must validate the parent origin.");
   assert(hostSource.includes("initialized ||"), "ONLYOFFICE host must only accept one initialization.");
   assert(hostSource.includes("message?.nonce"), "ONLYOFFICE host must require the in-memory nonce.");
+  assert(hostSource.includes("url.origin !== window.location.origin"), "ONLYOFFICE save-as URL must remain same-origin.");
+  assert(hostSource.includes('url.pathname.startsWith("/onlyoffice/")'), "ONLYOFFICE save-as URL must remain under the fixed proxy path.");
+  assert(hostSource.includes("postToParent(MESSAGE.SAVE_AS, { fileType, title, mimeType, data }, [data])"), "ONLYOFFICE save-as bridge must transfer validated file bytes.");
+  assert(!hostSource.includes("postToParent(MESSAGE.SAVE_AS, { fileType, title, url"), "ONLYOFFICE save-as bridge must not expose the signed result URL to business pages.");
+  assert(viewerSource.includes("allowSaveAs: props.allowSaveAs"), "ONLYOFFICE save-as must stay behind an explicit server capability.");
   assert(!/\b(?:localStorage|sessionStorage|console\.)\b/.test(hostSource), "ONLYOFFICE host must not persist or log signed configuration.");
   assert(apiSource.includes("cache: false"), "ONLYOFFICE signed config must not enter the desktop data cache.");
   assert(apiSource.includes("disableRequestDedupe: true"), "ONLYOFFICE signed config requests must not be deduplicated.");
@@ -290,22 +295,31 @@ const verifyRustBoundary = async () => {
     "updates::desktop_update_install",
     "desktop_menu_set_shortcuts",
     "desktop_window_set_theme",
+    "desktop_window_get_fullscreen",
+    "desktop_window_set_fullscreen",
   ];
   const unexpected = commands.filter((command) => !allowedCommands.includes(command));
   const missing = allowedCommands.filter((command) => !commands.includes(command));
   assert(unexpected.length === 0, `Unexpected Tauri commands: ${unexpected.join(", ") || "<none>"}.`);
   assert(missing.length === 0, `Missing expected Tauri commands: ${missing.join(", ") || "<none>"}.`);
+  assert(libSource.includes("window.is_fullscreen()"), "Desktop fullscreen state must be read from the native window.");
+  assert(libSource.includes(".set_fullscreen(fullscreen)"), "Desktop fullscreen changes must target the native window.");
+  assert(libSource.includes("DESKTOP_FULLSCREEN_CHANGED_EVENT"), "Native fullscreen state must be emitted back to the WebView.");
 };
 
 const verifyDesktopUiNativeSync = async () => {
   const menuSource = await readFile(resolve(sourceDir, "runtime/desktopMenu.ts"), "utf8");
   const preferencesSource = await readFile(resolve(sourceDir, "runtime/desktopUiPreferences.ts"), "utf8");
+  const fullscreenSource = await readFile(resolve(sourceDir, "runtime/webFullscreen.ts"), "utf8");
   const appSource = await readFile(resolve(sourceDir, "App.vue"), "utf8");
 
   assert(menuSource.includes('invoke("desktop_menu_set_shortcuts"'), "Desktop shortcuts must sync through the controlled Tauri command.");
   assert(menuSource.includes("DESKTOP_SHORTCUTS_CHANGED_EVENT"), "Native menu shortcuts must track preference changes.");
   assert(preferencesSource.includes('"system" | "light" | "dark"'), "Desktop theme must support following the system appearance.");
   assert(preferencesSource.includes('invoke("desktop_window_set_theme"'), "Desktop window theme must sync through the controlled Tauri command.");
+  assert(fullscreenSource.includes('invoke<boolean>("desktop_window_get_fullscreen"'), "Desktop fullscreen state must use the controlled Tauri query command.");
+  assert(fullscreenSource.includes('invoke<boolean>("desktop_window_set_fullscreen"'), "Desktop fullscreen changes must use the controlled Tauri mutation command.");
+  assert(fullscreenSource.includes("ctms:desktop-fullscreen-changed"), "Desktop fullscreen changes must synchronize native window state back to the WebView.");
   assert(preferencesSource.includes('matchMedia("(prefers-color-scheme: dark)")'), "System theme changes must update the WebView appearance.");
   assert(appSource.includes("initializeDesktopThemePreference()"), "Desktop theme synchronization must initialize at app startup.");
   assert(appSource.includes("initializeDesktopMenuShortcutSync()"), "Native menu shortcut synchronization must initialize at app startup.");

frontend/scripts/verify-runtime-boundary.mjs

@@ -9,6 +9,14 @@ const sourceExtensions = new Set([".ts", ".tsx", ".vue", ".js", ".jsx"]);
 const violations = [];
 const toPosixPath = (path) => path.split("\\").join("/");
 
+const platformSource = await readFile(resolve(runtimeDir, "platform.ts"), "utf8");
+if (!platformSource.includes("runtimeGlobal.isTauri")) {
+  violations.push("src/runtime/platform.ts: Tauri v2 runtime detection must use the official isTauri marker");
+}
+if (platformSource.includes("__TAURI")) {
+  violations.push("src/runtime/platform.ts: Tauri runtime detection must not depend on legacy or internal markers");
+}
+
 const walk = async (directory) => {
   const entries = await readdir(directory, { withFileTypes: true });
   return (
@@ -28,7 +36,7 @@ for (const path of await walk(sourceDir)) {
 
   const source = await readFile(path, "utf8");
   const file = toPosixPath(relative(frontendDir, path));
-  if (source.includes("@tauri-apps/") || source.includes("__TAURI")) {
+  if (source.includes("@tauri-apps/") || source.includes("__TAURI") || /(?:globalThis|window)\.isTauri/.test(source)) {
     violations.push(`${file}: direct Tauri access is only allowed inside src/runtime`);
   }
   if (/from\s+["'][^"']*\/runtime\/[^"']+["']/.test(source)) {