chore(sync): zsy_developcc 全量同步至 qyqy_develop（W26 口径）

- 分支内容对齐 qyqy_develop b6ec3aa，树完全一致（同步后 git diff 为空）
- 覆盖本轮全部交付：客服 Agent 重构（安全路由 / 五出口 / 记忆与画像 / RAG 全链路）
  + 开发文档 62 份编号体系（D1.1 v1.17 索引）
  + 新增 D2.10-客服Agent端到端答辩文档-2026-09-21.html
- 基线：e239eb7（2026-09-17 品牌口径统一快照），本提交为其直接后继

app/api/controllers/public_platform.py

@@ -1,6 +1,6 @@
 from typing import Any, Literal
 
-from fastapi import APIRouter, Depends, Header, Query
+from fastapi import APIRouter, Depends, Header, Path, Query
 from pydantic import Field
 
 from app.api.dependencies.auth import build_request_context
@@ -38,14 +38,16 @@ async def create_session(
 
 @router.get("/conversations/{session_id}")
 async def get_session(
-    session_id: str, context: RequestContext = Depends(build_request_context),  # noqa: B008
+    session_id: str = Path(min_length=1, max_length=64, pattern=r"^[A-Za-z0-9_-]+$"),
+    context: RequestContext = Depends(build_request_context),  # noqa: B008
 ) -> dict[str, Any]:
     return await PublicPlatformService().session(session_id, context)
 
 
 @router.post("/conversations/{session_id}/closures")
 async def close_session(
-    session_id: str, key: str | None = Header(default=None, alias="Idempotency-Key"),
+    session_id: str = Path(min_length=1, max_length=64, pattern=r"^[A-Za-z0-9_-]+$"),
+    key: str | None = Header(default=None, alias="Idempotency-Key"),
     context: RequestContext = Depends(build_request_context),  # noqa: B008
 ) -> dict[str, Any]:
     return await PublicPlatformService().write("close", session_id, context, key, {})
@@ -53,7 +55,8 @@ async def close_session(
 
 @router.post("/agent-runs/{run_id}/cancellations", status_code=202)
 async def cancel_run(
-    run_id: str, payload: Cancellation,
+    payload: Cancellation,
+    run_id: str = Path(min_length=1, max_length=64, pattern=r"^[A-Za-z0-9_-]+$"),
     key: str | None = Header(default=None, alias="Idempotency-Key"),
     context: RequestContext = Depends(build_request_context),  # noqa: B008
 ) -> dict[str, Any]:
@@ -62,7 +65,8 @@ async def cancel_run(
 
 @router.get("/handover-requests/{handover_id}")
 async def get_handover(
-    handover_id: str, context: RequestContext = Depends(build_request_context),  # noqa: B008
+    handover_id: str = Path(min_length=1, max_length=64, pattern=r"^[A-Za-z0-9_-]+$"),
+    context: RequestContext = Depends(build_request_context),  # noqa: B008
 ) -> dict[str, Any]:
     return await PublicPlatformService().handover(handover_id, context)
 
@@ -73,8 +77,8 @@ async def get_handover(
 # 导致转人工的异步链路（Outbox → Worker）永不触发，已合并删除。
 @router.post("/conversations/{session_id}/handover-requests", status_code=202)
 async def request_handover(
-    session_id: str,
     payload: HandoverRequest,
+    session_id: str = Path(min_length=1, max_length=64, pattern=r"^[A-Za-z0-9_-]+$"),
     key: str | None = Header(default=None, alias="Idempotency-Key"),
     context: RequestContext = Depends(build_request_context),  # noqa: B008
 ) -> dict[str, Any]: