fix(service): 使用 os.Root 修复 Sora 存储路径告警

- 将媒体写入和删除切换为 os.Root 沙箱 API
- 移除旧的路径拼接校验辅助函数并收敛删除逻辑
- 调整并新增相关单元测试覆盖删除行为

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/internal/service/sora_media_storage_test.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -92,20 +93,27 @@ func TestSoraMediaStorage_MaxDownloadBytes(t *testing.T) {
 	require.Error(t, err)
 }
 
-func TestJoinPathWithinDir(t *testing.T) {
-	baseDir := t.TempDir()
-
-	path1, err := joinPathWithinDir(baseDir, "ok.png")
-	require.NoError(t, err)
-	require.Equal(t, filepath.Join(baseDir, "ok.png"), path1)
-
-	_, err = joinPathWithinDir(baseDir, "../escape.png")
-	require.Error(t, err)
-}
-
 func TestNormalizeSoraFileExt(t *testing.T) {
 	require.Equal(t, ".png", normalizeSoraFileExt(".PNG"))
 	require.Equal(t, ".mp4", normalizeSoraFileExt(".mp4"))
 	require.Equal(t, "", normalizeSoraFileExt("../../etc/passwd"))
 	require.Equal(t, "", normalizeSoraFileExt(".php"))
 }
+
+func TestRemovePartialDownload(t *testing.T) {
+	tmpDir := t.TempDir()
+	root, err := os.OpenRoot(tmpDir)
+	require.NoError(t, err)
+	defer func() { _ = root.Close() }()
+
+	filePath := "partial.bin"
+	f, err := root.OpenFile(filePath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)
+	require.NoError(t, err)
+	_, _ = f.WriteString("partial")
+	_ = f.Close()
+
+	removePartialDownload(root, filePath)
+	_, err = root.Stat(filePath)
+	require.Error(t, err)
+	require.True(t, os.IsNotExist(err))
+}