新增 OTA WatchDog 编排与车队健康/报警后端。

覆盖包库回传、任务下发、CDM 任务同步与报警采集，并为包/任务 ID 与上传文件名加上路径安全校验。

Co-authored-by: Cursor <cursoragent@cursor.com>

MiGu.Server/appsettings.json

@@ -44,6 +44,15 @@
     "Dispatch": {
     }
   },
+  "_comment_Ota": "车辆 OTA：包与任务落盘 DataRoot；WatchDog:9776。拉包时车会 POST 到 WatchDog 配置的 serverIP:ReceivePort/upload-mdcs/*（默认 8000，与旧 Electron OTA 一致）。请把各车 watch_dog.json 的 serverIP 设为本机局域网 IP。",
+  "Ota": {
+    "DataRoot": "data/ota",
+    "WatchDogPort": 9776,
+    "ReceivePort": 8000,
+    "RequestTimeoutMs": 60000,
+    "UploadTimeoutMs": 600000,
+    "PublicBaseUrl": ""
+  },
   "_comment_ReverseProxy": "sl-route 兜底 AnyAuthed（投影只读 + SSE）。管理面路径（map-edit / ai-config / reflection 写操作）单独拆路由挂 PlatformScope，防止运营账号经反代直达地图编辑与任意反射调用。",
   "ReverseProxy": {
     "Routes": {
@@ -65,6 +74,15 @@
           { "PathRemovePrefix": "/api/sl" }
         ]
       },
+      "sl-assistant-route": {
+        "ClusterId": "sl-cluster",
+        "AuthorizationPolicy": "PlatformScope",
+        "Order": -2,
+        "Match": { "Path": "/api/sl/projection/assistant/{**catch-all}" },
+        "Transforms": [
+          { "PathRemovePrefix": "/api/sl" }
+        ]
+      },
       "sl-reflection-selection-route": {
         "ClusterId": "sl-cluster",
         "AuthorizationPolicy": "AnyAuthed",