Harden auth/vault path sanitization and clean WeKnora docs

rust/crates/mnote-editor-core/src/command.rs

@@ -210,22 +210,26 @@ fn move_block(
         .iter()
         .map(|block| block.id.clone())
         .collect();
-    if let Some(target_id) = after_block_id {
-        if moved_ids.iter().any(|id| id == target_id) {
-            return Err(CoreError::InvalidOperation("不能把块移动到自己的子树后面"));
-        }
-    }
-
-    let moved_blocks: Vec<DocumentBlock> = document.blocks_mut().drain(start..=end).collect();
+    // 先算好 drain 后的插入点，避免「先 drain 再发现目标不存在」导致块丢失。
     let insert_index = match after_block_id {
         Some(target_id) => {
+            if moved_ids.iter().any(|id| id == target_id) {
+                return Err(CoreError::InvalidOperation("不能把块移动到自己的子树后面"));
+            }
             let target_range = document
                 .subtree_range(target_id)
                 .ok_or_else(|| CoreError::BlockNotFound(target_id.to_string()))?;
-            *target_range.end() + 1
+            let target_end = *target_range.end();
+            // drain 会把 [start..=end] 移除：目标在段后时索引左移 removed 个位置。
+            if target_end > end {
+                target_end + 1 - (end - start + 1)
+            } else {
+                target_end + 1
+            }
         }
         None => 0,
     };
+    let moved_blocks: Vec<DocumentBlock> = document.blocks_mut().drain(start..=end).collect();
     document
         .blocks_mut()
         .splice(insert_index..insert_index, moved_blocks);