feat(models): 期1 模特库地基 — Model 顶级实体 + 模特库页 + 审核范围扩展

后端:
- 新增 Model(模特)团队级实体:形象图+三视图+声线(声线尾期),官方模板标签,软删
- Asset.Category 枚举一次加全(model_portrait/tri_view/voice/model_tryon/platform_kit/free_create/storyboard),逐期接线
- 送审范围 person → REVIEW_CATEGORIES{person,tri_view,storyboard}(review.py + adminpanel 队列),图片趴不送审;当前行为不变(forward-compat)
- /api/models/ ModelLibraryViewSet:本团队∪官方模板、官方/我的 tab、真人上传、软删(官方不可删)、跨团队资产引用防越权
- backfill_models 命令把历史成套模特(kind=model + 项目流命名配对)归集成 Model,dry-run 默认

前端:
- 左菜单新增「模特库」顶级入口(person 图标)+ 路由 /models
- 模特库页:全部/官方模板/我的模特 tab + 真人上传 + 模特卡(形象图+三视图缩略+官方标签),仅用 design token

测试:assets 10/10 绿;tsc+build 全绿;无头走查 0 console error(全部5/官方3/我的2,官方标签达标)
基线既有 7 失败(ai/projects provider mock 漂移)零新增

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

core/backend/apps/assets/serializers.py

@@ -1,7 +1,7 @@
 from django.conf import settings
 from rest_framework import serializers
 
-from .models import Asset, AssetFile
+from .models import Asset, AssetFile, Model
 from .storage import TosStorage
 
 
@@ -105,3 +105,71 @@ class AssetUploadSerializer(serializers.Serializer):
     category = serializers.ChoiceField(choices=Asset.Category.choices, default=Asset.Category.UPLOAD)
     description = serializers.CharField(required=False, allow_blank=True)
 
+
+def _asset_preview(asset) -> str:
+    """取资产主文件的公读直链(模特卡缩略图用)。无文件返回 ""。"""
+    if asset is None:
+        return ""
+    f = asset.files.filter(is_primary=True).first() or asset.files.first()
+    if f is None:
+        return ""
+    if f.preview_url:
+        return f.preview_url
+    if not f.object_key or not settings.TOS.get("endpoint"):
+        return ""
+    try:
+        return _tos().public_url(object_key=f.object_key, bucket=f.bucket or None)
+    except Exception:
+        return ""
+
+
+class ModelLibrarySerializer(serializers.ModelSerializer):
+    """模特库卡片:实体字段 + 形象图/三视图缩略图直链 + 是否已挂声线。"""
+
+    portrait = serializers.SerializerMethodField()
+    triview = serializers.SerializerMethodField()
+    has_voice = serializers.SerializerMethodField()
+
+    class Meta:
+        model = Model
+        fields = [
+            "id",
+            "name",
+            "is_official",
+            "source",
+            "description",
+            "metadata",
+            "portrait_asset",
+            "triview_asset",
+            "voice_asset",
+            "portrait",
+            "triview",
+            "has_voice",
+            "created_at",
+            "updated_at",
+        ]
+        read_only_fields = ["id", "is_official", "source", "created_at", "updated_at"]
+
+    def get_portrait(self, obj):
+        return _asset_preview(obj.portrait_asset)
+
+    def get_triview(self, obj):
+        return _asset_preview(obj.triview_asset)
+
+    def get_has_voice(self, obj):
+        return bool(obj.voice_asset_id)
+
+    def validate(self, attrs):
+        """防越权:引用的形象图/三视图/声线资产必须属于当前团队。"""
+        from apps.common.api import get_current_team
+
+        request = self.context.get("request")
+        if request is None:
+            return attrs
+        team = get_current_team(request.user)
+        for field in ("portrait_asset", "triview_asset", "voice_asset"):
+            asset = attrs.get(field)
+            if asset is not None and asset.team_id != team.id:
+                raise serializers.ValidationError({field: "资产不属于当前团队"})
+        return attrs
+