feat(ops): ECR-007 行为分析与 ECR-008 内容运营后台

落地埋点 ingest/数据看板、首页宫格 CMS 与测评上下架；含账号引导、问答流式与免责声明去重，以及 review P1 审计同事务修复。

Co-authored-by: Cursor <cursoragent@cursor.com>

server.py

@@ -464,6 +464,15 @@ class Handler(SimpleHTTPRequestHandler):
                 ip = os.path.join(dist_path, idx)
                 if os.path.isfile(ip):
                     return ip
+
+        # Missing hashed static assets must 404 (not SPA HTML) — otherwise browsers
+        # reject module scripts as wrong MIME type after a redeploy.
+        lower = clean.lower()
+        if lower.startswith('/assets/') or lower.endswith((
+            '.js', '.css', '.map', '.mjs', '.wasm', '.png', '.jpg', '.jpeg',
+            '.gif', '.webp', '.svg', '.ico', '.woff', '.woff2', '.ttf',
+        )):
+            return dist_path  # nonexistent → parent handler 404
         
         # SPA fallback: serve dist/index.html for client-side routes
         spa_index = os.path.join(VUE_DIST, 'index.html')