wip: 客服Agent + RAG + 画像收尾（基于 6516ccb）

tests/unit/api/test_controller_routing_contract.py

@@ -25,6 +25,7 @@ PROTECTED_GET = [
     "/api/v1/knowledge-references/token-abcdefghijklmnopqrst",
     "/api/v1/users/me/memory-profile",
     "/api/v1/admin/config-releases",
+    "/api/v1/knowledge/list",
 ]
 
 PROTECTED_POST = [
@@ -34,6 +35,11 @@ PROTECTED_POST = [
     "/api/v1/conversations/session-1/handover-requests",
     "/api/v1/agent-runs/run-x/cancellations",
     "/api/v1/conversation-messages/1/feedback",
+    "/api/v1/knowledge/upload",
+]
+
+PROTECTED_DELETE = [
+    "/api/v1/knowledge/1",
 ]
 
 PUBLIC_GET = ["/internal/health/live"]
@@ -60,6 +66,14 @@ async def test_protected_post_without_token_never_succeeds(path: str) -> None:
     assert response.status_code in {401, 422}, f"POST {path} -> {response.status_code}"
 
 
+@pytest.mark.parametrize("path", PROTECTED_DELETE)
+async def test_protected_delete_without_token_is_unauthorized(path: str) -> None:
+    """DELETE 没有请求体可校，所以未带令牌必须是明确的 401（知识库删除端点的闸门）。"""
+    response = await send("DELETE", path)
+
+    assert response.status_code == 401, f"DELETE {path} -> {response.status_code}"
+
+
 @pytest.mark.parametrize("path", PUBLIC_GET)
 async def test_public_operational_route_is_reachable(path: str) -> None:
     response = await send("GET", path)