feat: complete M1-M3 infrastructure — OSS client, native execution chain, rule lifecycle API, system docs

- M1: unified OSS client (upload/download/presign) + path utils + config
- M2: rule service with validate/create/publish/rollback + binding CRUD endpoints
- M3: native AuditCtx runner, file/rule resolvers, storage adapter with full persistence
- docs: SYSTEM_OVERVIEW.md as comprehensive architecture reference
- fix: double finalize — terminal state now written once by finalize_run

fastapi_modules/fastapi_leaudit/services/ossService.py

@@ -0,0 +1,55 @@
+"""OSS 服务接口。"""
+
+from abc import ABC, abstractmethod
+
+
+class IOssService(ABC):
+    """OSS 服务接口。"""
+
+    @abstractmethod
+    async def DownloadBytes(self, Source: str, Bucket: str | None = None) -> bytes:
+        """下载对象内容。"""
+        ...
+
+    @abstractmethod
+    async def DownloadToTempFile(
+        self,
+        Source: str,
+        Suffix: str = "",
+        Prefix: str = "oss-",
+        Bucket: str | None = None,
+    ) -> str:
+        """下载对象到本地临时文件。"""
+        ...
+
+    @abstractmethod
+    async def UploadBytes(
+        self,
+        ObjectKey: str,
+        Content: bytes,
+        ContentType: str = "application/octet-stream",
+        Bucket: str | None = None,
+    ) -> str:
+        """上传二进制内容。"""
+        ...
+
+    @abstractmethod
+    async def UploadText(
+        self,
+        ObjectKey: str,
+        Content: str,
+        ContentType: str = "text/plain; charset=utf-8",
+        Bucket: str | None = None,
+    ) -> str:
+        """上传文本内容。"""
+        ...
+
+    @abstractmethod
+    async def ObjectExists(self, Source: str, Bucket: str | None = None) -> bool:
+        """判断对象是否存在。"""
+        ...
+
+    @abstractmethod
+    async def PresignGetUrl(self, Source: str, Bucket: str | None = None) -> str:
+        """生成对象下载签名 URL。"""
+        ...