feat: add artifact library and improve public wiki

offline-backend-20260512/backend/README.md

@@ -153,6 +153,7 @@ FastAPI application providing REST endpoints for frontend integration:
 | `POST /api/threads/{id}/uploads` | Upload files (auto-converts PDF/PPT/Excel/Word to Markdown, rejects directory paths) |
 | `GET /api/threads/{id}/uploads/list` | List uploaded files |
 | `DELETE /api/threads/{id}` | Delete DeerFlow-managed local thread data after LangGraph thread deletion; unexpected failures are logged server-side and return a generic 500 detail |
+| `GET /api/artifact-library` | List the current user's generated conversation files across normal threads, with filename/conversation search, file-kind filtering, pagination, and an optional cache-bypassing refresh. The filesystem `outputs/` directories remain authoritative; uploads and image/audio/video files are excluded. |
 | `GET /api/threads/{id}/artifacts/{path}` | Serve generated artifacts |
 | `GET/POST /api/deep-research/*` | Durable Deep Research sessions and jobs. `quick`/`basic` run the compact report flow; `detailed` plans subtopics and writes independent sections; `deep` recursively investigates bounded follow-up branches. All modes reuse DeerFlow's configured material provider, LLM factory, hidden-thread artifacts, and SSE event log. Deep Research session/job/event/source/message writes serialise their rows in the writer transaction, rather than doing a post-commit ORM refresh or readback; this prevents MySQL read/write-splitting replica lag from failing “start writing”, dispatcher claim, report persistence, or follow-up history. Whole-document artifact/report rewrites likewise create their reversible version snapshots from writer-local ORM data and never refresh after commit, so replica lag cannot restore an otherwise successful rewrite. A report is written to the session and confirmed before its Job becomes `completed`; an unconfirmed write is retried and never exposed as a false completion. Retrying an already-created queued job re-nudges the dispatcher, recovering an interrupted HTTP response without creating a second report. If progress-event persistence, durable replay, or live fan-out is briefly unavailable, the worker/stream logs the degradation and continues or reconnects rather than failing the whole job. Whole-report rewrite accepts an optional `reportOutline` Markdown template; the durable job persists it and applies it as the chapter structure constraint. Optional report illustrations use a separately configured OpenAI-compatible image endpoint and are served only through the owning session's authenticated artifact route. |
 | `/api/enterprise-research/*` | Temporarily disabled. Its router and persistence initialization are not registered, so these endpoints return 404 and no enterprise-research tables are created or migrated during startup. |
@@ -865,8 +866,10 @@ report-structure column for databases stamped by either old variant.
 Published knowledge bases also have a login-free, chrome-free reader at
 `/#/embed/knowledge/{mapping_id}` for direct third-party iframe use. With no
 `wikiSlug`, it selects the Wiki **索引** page first (recognized by title, page
-type, or `index`/`home`/`readme` slug), pins that page to the top of the public
-directory, and otherwise falls back to an overview/root page;
+type, or `index`/`home`/`readme` slug) and pins that page to the top of the
+public directory. If WeKnora has pages but no explicit index page, the reader
+creates a virtual `__index__` landing page from the public directory; empty
+dynamic-index groups also fall back to those page summaries;
 `?wikiSlug=...` deep-links one page. The reader supports
 `theme=light|dark`, `bg`, and `text` embed appearance parameters. Index-article
 catalogue sections (page-type counts, nested categories, page summaries) are
@@ -882,8 +885,14 @@ only from the read-only `/api/public/llmwiki/knowledge-bases/{id}/...` namespace
 which rechecks `publication_status=published` on every request and denies the
 system conversation-deposit knowledge base. Private or unpublished bases are
 never exposed by this route. Anonymous consumers can discover the available
-public Wiki libraries through `GET /api/public/llmwiki/knowledge-bases`; each
-entry deliberately contains only the DeerFlow mapping `id` and display `name`.
+public Wiki libraries through `GET /api/public/llmwiki/knowledge-bases`. The
+endpoint validates each published mapping against WeKnora, omits stale remote
+mappings, and returns safe comprehensive metadata: description/type,
+document/chunk/processing/share counts, non-secret configuration and
+timestamps, Wiki page/type/status counts plus explicit/generated index mode and
+default embed route, and aggregate local-vector state/counts/timestamps. It
+never returns the WeKnora id, tenant/creator identity, storage credentials, API
+credentials, raw vectors, or per-page indexing errors.
 Protected `resource://` and supported object-storage images are fetched through
 the current mapping instead of being exposed as upstream URLs. Authenticated
 readers use `GET /api/llmwiki/knowledge-bases/{id}/files?file_path=...`; public