功能(文档预览)：集成 ONLYOFFICE 安全只读预览与工作台体验

新增 ONLYOFFICE 配置签名、内部内容接口、容器编排与反向代理。

打通网页端和桌面端独立预览工作区，完善文档入口、布局及帮助体验。

补充桌面安全发布门禁、开发脚本、使用文档和前后端测试。

nginx/nginx.conf

@@ -28,6 +28,26 @@ http {
         server backend:8000 resolve;
     }
 
+    upstream onlyoffice {
+        zone onlyoffice 64k;
+        server onlyoffice:80 resolve;
+    }
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        "" close;
+    }
+
+    map $http_x_forwarded_proto $onlyoffice_scheme {
+        default $http_x_forwarded_proto;
+        "" $scheme;
+    }
+
+    map $http_x_forwarded_host $onlyoffice_host {
+        default $http_x_forwarded_host;
+        "" $http_host;
+    }
+
     server {
         listen 80;
         server_name _;
@@ -47,6 +67,17 @@ http {
             add_header Cache-Control "no-store, no-cache, must-revalidate" always;
         }
 
+        location = /onlyoffice-host.html {
+            try_files /onlyoffice-host.html =404;
+            add_header Cache-Control "no-store" always;
+            add_header Content-Security-Policy "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; frame-src 'self' blob:; frame-ancestors 'self' tauri: http://tauri.localhost https://tauri.localhost http://localhost:* http://127.0.0.1:*; object-src 'none'; base-uri 'none'; form-action 'none'" always;
+        }
+
+        location = /onlyoffice-host.js {
+            try_files /onlyoffice-host.js =404;
+            add_header Cache-Control "no-store" always;
+        }
+
         location /assets/ {
             try_files $uri =404;
             add_header Cache-Control "public, max-age=31536000, immutable" always;
@@ -66,6 +97,19 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
         }
 
+        location /onlyoffice/ {
+            proxy_pass http://onlyoffice/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Forwarded-Host $onlyoffice_host/onlyoffice;
+            proxy_set_header X-Forwarded-Proto $onlyoffice_scheme;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_read_timeout 3600s;
+            proxy_send_timeout 3600s;
+        }
+
         location /health {
             proxy_pass http://backend;
             proxy_set_header Host $host;