refactor: 收口 onlyoffice callback 本地类型

- 去掉 callback 写回链中的宽泛 any 访问，改为最小资产/权限类型

- 复用 documentId/workspaceId/mimeType 局部变量，保持回调写回逻辑更稳定可读

wolai-frontend/src/app/api/onlyoffice/callback/route.ts

@@ -22,6 +22,16 @@ type OnlyOfficeCallbackBody = {
   key?: string;
 };
 
+type OnlyOfficeAssetRecord = {
+  document_id?: string | null;
+  workspace_id?: string | null;
+  mime_type?: string | null;
+};
+
+type OnlyOfficePermission = {
+  permission?: string | null;
+};
+
 const normalizeSecret = (raw: string) => {
   const trimmed = String(raw || "").trim();
   if (!trimmed) return "";
@@ -98,18 +108,23 @@ export async function POST(request: Request) {
         "dev-user";
       const client = getConvexHttpClient();
 
-      const asset = await client.query(api.mediaAssets.getById, { userId, id: assetId });
+      const asset = (await client.query(api.mediaAssets.getById, { userId, id: assetId })) as
+        | OnlyOfficeAssetRecord
+        | null;
       if (!asset) {
         return NextResponse.json({ error: 1 });
       }
+      const documentId = String(asset.document_id || "").trim();
+      const workspaceId = String(asset.workspace_id || "").trim() || null;
+      const mimeType = String(asset.mime_type || "").trim() || "application/octet-stream";
 
       // 只读权限：不允许通过 ONLYOFFICE 回调写回
       try {
-        const perm = await client.query(api.documents.getPermissionForUser, {
+        const perm = (await client.query(api.documents.getPermissionForUser, {
           userId,
-          id: String((asset as any).document_id || ""),
-        });
-        if (!perm || (perm as any).permission !== "edit") {
+          id: documentId,
+        })) as OnlyOfficePermission | null;
+        if (!perm || perm.permission !== "edit") {
           return NextResponse.json({ error: 1 });
         }
       } catch {
@@ -131,7 +146,7 @@ export async function POST(request: Request) {
 
       const uploadRes = await fetch(uploadUrl, {
         method: "POST",
-        headers: { "Content-Type": asset.mime_type || "application/octet-stream" },
+        headers: { "Content-Type": mimeType },
         body: buf,
       });
 
@@ -147,7 +162,7 @@ export async function POST(request: Request) {
 
       const bridgeContext = buildDocumentBridgeContextWithActor({
         request,
-        workspaceId: String((asset as any).workspace_id || "").trim() || null,
+        workspaceId,
         actor: {
           actorType: "service",
           actorId: userId,
@@ -163,15 +178,15 @@ export async function POST(request: Request) {
         name: "media.assets.replace_storage",
         payload: {
           assetId,
-          documentId: String((asset as any).document_id || "").trim(),
-          workspaceId: String((asset as any).workspace_id || "").trim() || null,
+          documentId,
+          workspaceId,
           storageId,
           userId,
         } satisfies MediaAssetReplaceStoragePayload,
         context: bridgeContext,
         target: {
-          workspaceId: String((asset as any).workspace_id || "").trim() || null,
-          pageId: String((asset as any).document_id || "").trim() || null,
+          workspaceId,
+          pageId: documentId || null,
         },
         reason: "ONLYOFFICE 回调写回附件存储",
         refs: [`onlyoffice:asset:${assetId}`],