修复全页面走查发现的 P0 前端问题（第一批）

八个 agent 对 11 章逐页对照设计稿+后端源码后，先修其中"功能不可用/崩溃/谎报成功"级别的：

崩溃与数据错误
- content-library-view: Highlight 按 [start,len] 数组解构后端返回的 {start,end} 对象，
  对象不可迭代会直接抛 TypeError，任何文本搜索命中都让整个结果区渲染崩掉。服务端偏移还叠加
  两个问题（Go 字节下标 vs JS UTF-16；偏移基准是全文但 snippet 会被开窗截断），改为在展示
  文本上本地匹配关键词。
- content-library-view: firstAttachment 用 Drafty.attachments，SDK 里硬过滤 tp=='EX'
  只认文件附件，图片(IM)/视频(VD)/语音(AU) 一个都取不到——收藏缩略图、语音播放源、聊天记录
  图片视频宫格全部拿不到资源。改用 Drafty.entities 按类型分派（chat-message.jsx 已有先例）。
- message-center-view: 系统通知的机器码兜底会把真实数据吞掉（日报提醒的 summary 就是日期
  字符串 "2026-08-20"，会议通知的 summary 是标题），改为查表命中才替换。
- message-center-view: 会话列表漏了 avatar 字段，每行都只能落到兜底图标；同文件
  frequentContacts() 本来就是对的，照它补上。

功能不可用
- auth-onboarding-view: 首次开启青少年模式是死路——设完密码丢弃了服务端返回的
  enable_action_token，从不调 enableYouthMode，用户走完短信验证+设密码后模式仍是关的。
  现在拿着这个 token 把最后一步做完。
- group-management-view: "投诉/举报"是个 onToast('暂未开放') 死桩，而 target_type='group'
  这条链路早就通了。接上真实举报页。
- tinode-web: 刷新/深链会被弹回首页。两个原因叠加：初始化白名单还是上游 Tinode 的
  ['cred','reset','register']；handleLoginSuccessful 无条件把 hash 改写成 workbench，
  刷新触发的自动登录也走这条。抽出 SIDE_PANEL_VIEWS 常量复用，并区分登录流程与自动登录。
- widgets/meta-message: deleted 分支从未实现，撤回一条消息后时间线上什么都不剩。

谎报成功 / 判定错误
- tinode-web + personal-settings-view: 改密码不返回 Promise，服务端拒绝时照样弹"密码已更新"。
- group-management-view: 禁言批量读 result.succeeded，但该接口返回的是 {topic, items}，
  succeeded 恒为 undefined，不管成没成都弹"设置成功"。两个接口结构不同，分开判定。
- workplace-collaboration-view: 会议取消状态写成 'cancelled'，后端是 'canceled' 单 l，
  会议取消后"取消会议"按钮还挂着。

样式与显示
- base.css: 删掉旧版 .organization-department 的 padding-left !important，它压过按层级算出的
  内联缩进，导致部门行全平、只有人员行缩进。
- base.css: 补 .youth-password-gate（原来 0 条规则），PIN 框缺 position:relative 和居中。
- security-support-view: shield_lock 不在经典 Material Icons 里（只有 Symbols），会显示成
  字面文本；.risk-info-page 也是 0 条规则，整页渲染成裸项目符号列表。改用 verified_user 并
  补上 .risk-dialog。
- contact-management-view: 好友资料页性别直接输出后端枚举，显示成 "male"。
- workplace-collaboration-view: 层级标注两条路径两种格式（树形深三层变"3级"、搜索硬传"三"），
  统一成一个 helper。

已记录不在前端修的后端缺口：recallMessage 的 version 只能传 1，因为所有消息读取接口
（messagePayload/messageSearchPayload/mediaMessagePayload/favoriteSnapshot）都不下发 version，
冲突错误里也不回传真实值，被编辑过的消息撤回必然失败。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/views/tinode-web.jsx

@@ -101,6 +101,59 @@ const messages = defineMessages({
   }
 });
 
+// 全部合法的侧栏视图名。抽成模块级常量而不是内联在 handleHashRoute 里，是因为初始化时的
+// "要不要保留 hash" 判断也需要同一份名单——那里原来写的是上游 Tinode 遗留的
+// ['cred','reset','register'] 三个名字，本工程新增的上百个路由一个都不在里面，导致带任何新路由的
+// 地址刷新/深链进入都会被 navigateTo('') 清空 hash 弹回首页。
+const SIDE_PANEL_VIEWS = ['acc_general','archive','blocked','contacts','cred','crop','edit','general',
+          'newtpk','notif','register','reset','security','settings','support','wallpapers',
+          'tenant','login','enterprise-register','enterprise-feedback','identity-check',
+          'realname','realname-verified','realname-reminder','independent-password',
+          'messages-home','messages-offline','messages-menu','message-actions','system-messages',
+          'chat-inbound-request','chat-inbound-message','chat-outbound-request','chat-status',
+          'chat-friend','chat-media','chat-blocked','chat-deleted','chat-standard',
+          'chat-attachments','chat-mixed','chat-contact-card',
+          'compose-keyboard','mentions-select','mentions-complete','mentions-message',
+          'emoji-panel','emoji-message','voice-ready','voice-hold','voice-recording',
+          'media-uploading','media-gallery','media-retry','upload-file','file-message',
+          'message-multiselect','favorite-success','forward-select','forward-multiple',
+          'forward-individual','forward-bundle',
+          'address-book','friend-requests','add-friend','my-friend-qr','friend-search-result',
+          'friend-verification','friend-profile','group-member-profile','friend-settings',
+          'friend-settings-blocked','friend-delete-confirm','block-list','block-confirm','clear-chat-confirm',
+          'group-list','group-empty','group-invite','group-events','group-join-requests',
+          'group-new-request','group-announcement','group-summary','group-announcement-detail',
+          'group-settings','group-profile','group-avatar','group-nickname','group-description',
+          'group-my-nickname','group-role-message','group-qr','group-governance','group-admins','group-admin-add',
+          'group-admin-success','group-admin-partial','group-admin-removed','group-mute-add',
+          'group-muted','group-owner-select','group-owner-confirm','group-files','group-file-upload',
+          'favorites','favorites-mixed','favorites-files','favorites-text','favorites-voice',
+          'favorites-links','favorites-select','favorite-share','file-download','file-downloading',
+          'file-downloaded','history-search','history-files','history-links','history-images','history-videos',
+          'call-history','call-incoming','audio-call-ringing','audio-call-active','audio-call-muted',
+          'audio-call-speaker','video-call-ringing','video-call-camera-off','video-call-active',
+          'video-call-peer-camera-off','call-minimized',
+          'workbench','organization-directory','meeting-organizer','meeting-attendee',
+          'meeting-create','meeting-detail',
+          'daily-report-editor','daily-report-mine','daily-report-team','daily-report-detail',
+          'monthly-report-editor','monthly-report-list','monthly-report-detail',
+          'executive-mailbox','executive-mailbox-notice',
+          'personal-center','personal-profile','profile-nickname','profile-birth-date',
+          'profile-signature','profile-gender','profile-region','personal-qrcode','android-settings',
+          'cache-clear-confirm','clear-history-confirm','change-password','delete-account-confirm',
+          'app-version','privacy-settings','friend-discovery-settings',
+          'youth-mode-off','youth-mode-on','youth-mode-verify',
+          'notification-permission','permission-settings-reminder','camera-permission-info',
+          'microphone-permission-info',
+          'fraud-risk-warning','fraud-risk-confirmation','abuse-report-reasons',
+          'abuse-report-details','user-feedback',
+          ''];
+
+// 登录流程本身的页面。从这些页面登录成功后应该落到工作台；从任何其它页面（刷新触发的自动登录）
+// 则应该留在原处。
+const AUTH_FLOW_VIEWS = ['tenant', 'login', 'register', 'reset', 'cred',
+  'enterprise-register', 'enterprise-feedback'];
+
 class TinodeWeb extends React.Component {
   constructor(props) {
     super(props);
@@ -431,7 +484,7 @@ class TinodeWeb extends React.Component {
       // Parse the hash navigation params.
       const parsedNav = HashNavigation.parseUrlHash(window.location.hash);
       // Maybe navigate to home screen.
-      if (!['cred', 'reset', 'register'].includes(parsedNav.path[0])) {
+      if (!SIDE_PANEL_VIEWS.includes(parsedNav.path[0]) || !parsedNav.path[0]) {
         // Save possible topic name.
         this.setState({requestedTopic: parsedNav.path[1]});
         const path = parsedNav.params && parsedNav.params.cred_done ?
@@ -650,49 +703,7 @@ class TinodeWeb extends React.Component {
 
     if (hash.path && hash.path.length > 0) {
       // Left-side panel selector.
-      if (['acc_general','archive','blocked','contacts','cred','crop','edit','general',
-          'newtpk','notif','register','reset','security','settings','support','wallpapers',
-          'tenant','login','enterprise-register','enterprise-feedback','identity-check',
-          'realname','realname-verified','realname-reminder','independent-password',
-          'messages-home','messages-offline','messages-menu','message-actions','system-messages',
-          'chat-inbound-request','chat-inbound-message','chat-outbound-request','chat-status',
-          'chat-friend','chat-media','chat-blocked','chat-deleted','chat-standard',
-          'chat-attachments','chat-mixed','chat-contact-card',
-          'compose-keyboard','mentions-select','mentions-complete','mentions-message',
-          'emoji-panel','emoji-message','voice-ready','voice-hold','voice-recording',
-          'media-uploading','media-gallery','media-retry','upload-file','file-message',
-          'message-multiselect','favorite-success','forward-select','forward-multiple',
-          'forward-individual','forward-bundle',
-          'address-book','friend-requests','add-friend','my-friend-qr','friend-search-result',
-          'friend-verification','friend-profile','group-member-profile','friend-settings',
-          'friend-settings-blocked','friend-delete-confirm','block-list','block-confirm','clear-chat-confirm',
-          'group-list','group-empty','group-invite','group-events','group-join-requests',
-          'group-new-request','group-announcement','group-summary','group-announcement-detail',
-          'group-settings','group-profile','group-avatar','group-nickname','group-description',
-          'group-my-nickname','group-role-message','group-qr','group-governance','group-admins','group-admin-add',
-          'group-admin-success','group-admin-partial','group-admin-removed','group-mute-add',
-          'group-muted','group-owner-select','group-owner-confirm','group-files','group-file-upload',
-          'favorites','favorites-mixed','favorites-files','favorites-text','favorites-voice',
-          'favorites-links','favorites-select','favorite-share','file-download','file-downloading',
-          'file-downloaded','history-search','history-files','history-links','history-images','history-videos',
-          'call-history','call-incoming','audio-call-ringing','audio-call-active','audio-call-muted',
-          'audio-call-speaker','video-call-ringing','video-call-camera-off','video-call-active',
-          'video-call-peer-camera-off','call-minimized',
-          'workbench','organization-directory','meeting-organizer','meeting-attendee',
-          'meeting-create','meeting-detail',
-          'daily-report-editor','daily-report-mine','daily-report-team','daily-report-detail',
-          'monthly-report-editor','monthly-report-list','monthly-report-detail',
-          'executive-mailbox','executive-mailbox-notice',
-          'personal-center','personal-profile','profile-nickname','profile-birth-date',
-          'profile-signature','profile-gender','profile-region','personal-qrcode','android-settings',
-          'cache-clear-confirm','clear-history-confirm','change-password','delete-account-confirm',
-          'app-version','privacy-settings','friend-discovery-settings',
-          'youth-mode-off','youth-mode-on','youth-mode-verify',
-          'notification-permission','permission-settings-reminder','camera-permission-info',
-          'microphone-permission-info',
-          'fraud-risk-warning','fraud-risk-confirmation','abuse-report-reasons',
-          'abuse-report-details','user-feedback',
-          ''].includes(hash.path[0])) {
+      if (SIDE_PANEL_VIEWS.includes(hash.path[0])) {
         newState.sidePanelSelected = hash.path[0];
         newState.sidePanelParams = hash.params;
       } else {
@@ -1011,7 +1022,15 @@ class TinodeWeb extends React.Component {
     // The new bottom nav only has "workbench" and "messages" -- there's no standalone contacts
     // entry point anymore, so landing a fresh login there orphaned the user outside the nav they can
     // actually see. Land on the workbench instead (matches the "工作台优先" home screen in the mocks).
-    let urlHash = HashNavigation.setUrlSidePanel(window.location.hash, 'workbench');
+    //
+    // 但只在"真的刚走完登录流程"时才这么跳。这个方法在页面刷新触发自动登录时也会执行，原来无条件
+    // 改写 hash，等于把用户刷新前所在的页面冲掉——不管停在个人中心、群设置还是收藏，刷新后一律
+    // 被弹到工作台。现在先看当前 hash 是不是一个有效的、非登录流程的视图，是就原样保留。
+    const currentView = HashNavigation.parseUrlHash(window.location.hash).path[0];
+    const cameFromAuthFlow = !currentView || AUTH_FLOW_VIEWS.includes(currentView) ||
+      !SIDE_PANEL_VIEWS.includes(currentView);
+    let urlHash = cameFromAuthFlow ?
+      HashNavigation.setUrlSidePanel(window.location.hash, 'workbench') : window.location.hash;
     if (goToTopic) {
       urlHash = HashNavigation.setUrlTopic(urlHash, goToTopic);
     }
@@ -1739,10 +1758,17 @@ class TinodeWeb extends React.Component {
   handleUpdatePasswordRequest(password)  {
     this.handleError();
 
-    if (password) {
-      this.tinode.updateAccountBasic(null, this.tinode.getCurrentLogin(), password)
-        .catch(err => this.handleError(err.message, 'err'));
+    if (!password) {
+      return Promise.reject(new Error('密码不能为空'));
     }
+    // 必须把 Promise 返回出去：调用方（personal-settings-view 的修改密码页）要靠它判断成败。
+    // 原来这里只在内部 catch 掉、什么都不返回，调用方拿到 undefined，于是密码策略被服务端拒绝时
+    // 用户照样看到"密码已更新"并被跳走。跟之前修过的 handleDeleteAccount 是同一类问题。
+    return this.tinode.updateAccountBasic(null, this.tinode.getCurrentLogin(), password)
+      .catch(err => {
+        this.handleError(err.message, 'err');
+        throw err;
+      });
   }
 
   handleChangePermissions(topicName, mode, uid) {