Harden auth/vault path sanitization and clean WeKnora docs

rust/crates/mnote-web/src/routes/stream_support.rs

@@ -624,9 +624,17 @@ pub async fn load_stream_overview(
     context: &RequestContext,
     query: &StreamSnapshotQuery,
 ) -> Result<(String, Value), WebError> {
+    // resolve_effective_workspace_id(require=true) 在缺失时已返回 Err，不再用 expect panic。
     let effective_workspace_id =
-        resolve_effective_workspace_id(context, query.workspace_id.as_deref(), true)?
-            .expect("workspace_required 已确保存在");
+        resolve_effective_workspace_id(context, query.workspace_id.as_deref(), true)?.ok_or_else(
+            || {
+                WebError::bad_request_code(
+                    "workspace_required",
+                    "缺少 workspaceId，请在 query 或请求头中提供有效工作区",
+                )
+                .with_context(context)
+            },
+        )?;
     let overview = execute_runtime_query_via_legacy_cloud(
         config,
         context,
@@ -643,8 +651,15 @@ pub async fn load_stream_snapshot(
     query: &StreamSnapshotQuery,
 ) -> Result<Value, WebError> {
     let effective_workspace_id =
-        resolve_effective_workspace_id(context, query.workspace_id.as_deref(), true)?
-            .expect("workspace_required 已确保存在");
+        resolve_effective_workspace_id(context, query.workspace_id.as_deref(), true)?.ok_or_else(
+            || {
+                WebError::bad_request_code(
+                    "workspace_required",
+                    "缺少 workspaceId，请在 query 或请求头中提供有效工作区",
+                )
+                .with_context(context)
+            },
+        )?;
     let scope = resolve_stream_scope(query);
 
     let snapshot = match scope {
@@ -653,8 +668,13 @@ pub async fn load_stream_snapshot(
                 .await?
         }
         StreamSnapshotScope::Subtree => {
-            let root_node_id =
-                normalize_root_node_id(query).expect("subtree scope 已确保 rootNodeId 存在");
+            let root_node_id = normalize_root_node_id(query).ok_or_else(|| {
+                WebError::bad_request_code(
+                    "stream_root_node_required",
+                    "subtree 流需要 rootNodeId",
+                )
+                .with_context(context)
+            })?;
             let dataset = load_sidebar_dataset(config, context, &effective_workspace_id).await?;
             let tree = execute_kernel_query(
                 context,