fix: dSYM/混淆映射下载缺少认证头导致下载失败，dSYM 远端下载改为签名链接

历史记录点击 dSYM 下载后停留在接口地址本身：window.open 无法带
Authorization 头，接口未认证直接 401，重定向逻辑根本没机会执行。
改为前端先用 authFetch 认证请求，再按返回类型跳转远端地址或保存二
进制文件；远端地址同时改造成与 IPA 一致的 OSS 签名短时链接，避免
未签名地址在私有 bucket 下被拒绝。

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/src/views/HistoryView.vue

@@ -309,8 +309,36 @@ onUnmounted(() => {
   if (logWs) { logWs.close(); logWs = null }
 })
 
-const downloadDsym = (taskId) => {
-  window.open(`/api/tasks/${taskId}/dsym`)
+const triggerBlobDownload = (blob, filename) => {
+  const url = URL.createObjectURL(blob)
+  const a = document.createElement('a')
+  a.href = url
+  a.download = filename || ''
+  document.body.appendChild(a)
+  a.click()
+  a.remove()
+  URL.revokeObjectURL(url)
+}
+
+const filenameFromDisposition = (res, fallback) => {
+  const cd = res.headers.get('content-disposition') || ''
+  const match = cd.match(/filename\*?=(?:UTF-8'')?"?([^";]+)"?/i)
+  return match ? decodeURIComponent(match[1]) : fallback
+}
+
+const downloadDsym = async (taskId) => {
+  try {
+    const res = await authFetch(`/api/tasks/${taskId}/dsym`)
+    if (!res.ok) throw new Error()
+    if ((res.headers.get('content-type') || '').includes('application/json')) {
+      const { url } = await res.json()
+      window.open(url, '_blank')
+    } else {
+      triggerBlobDownload(await res.blob(), filenameFromDisposition(res, 'dsym.zip'))
+    }
+  } catch {
+    alert('下载失败，请稍后重试')
+  }
 }
 
 const downloadIpa = async (taskId) => {
@@ -328,8 +356,14 @@ const downloadIpa = async (taskId) => {
   }
 }
 
-const downloadObfMaps = (taskId) => {
-  window.open(`/api/tasks/${taskId}/obfuscation-maps`)
+const downloadObfMaps = async (taskId) => {
+  try {
+    const res = await authFetch(`/api/tasks/${taskId}/obfuscation-maps`)
+    if (!res.ok) throw new Error()
+    triggerBlobDownload(await res.blob(), filenameFromDisposition(res, 'obfuscation_maps.zip'))
+  } catch {
+    alert('下载失败，请稍后重试')
+  }
 }
 
 const deleteTask = async (taskId) => {