fix: align media errors and serialize bigint server IDs

tests/integration/local-api-auth.test.ts

@@ -213,20 +213,38 @@ describe('Local API authentication', () => {
     }
   })
 
-  it('maps media lookup failures to stable API statuses', async () => {
+  it.each([
+    ['NOT_FOUND', '未找到图片消息', 404],
+    ['NOT_FOUND', '图片文件不存在', 404],
+    ['NOT_IMAGE', '消息不是可读取的图片消息', 422]
+  ] as const)('maps %s (%s) to HTTP %s', async (code, message, status) => {
     const handle = await startFixtureServer(
       () => VALID_TOKEN,
       async () => {
-        throw new HttpMediaError('NOT_IMAGE', '消息不是可读取的图片消息')
+        throw new HttpMediaError(code, message)
       }
     )
-    const response = await fetch(`${baseUrl(handle)}/api/v1/media/message-1`, {
+    const response = await fetch(`${baseUrl(handle)}/api/v1/media/image%3Aunresolved`, {
       headers: { Authorization: `Bearer ${VALID_TOKEN}` }
     })
-    expect(response.status).toBe(422)
-    await expect(response.json()).resolves.toMatchObject({ status: 422 })
+    expect(response.status).toBe(status)
+    await expect(response.json()).resolves.toMatchObject({ status, error: message })
   })
 
+  it.each(['%ZZ', 'image%2Finvalid', 'image%5Cinvalid'])(
+    'rejects malformed media identifiers (%s) before lookup',
+    async (identifier) => {
+      const provider = vi.fn(async () => ({ buffer: Buffer.from('image'), mimeType: 'image/png' }))
+      const handle = await startFixtureServer(() => VALID_TOKEN, provider)
+      const response = await fetch(`${baseUrl(handle)}/api/v1/media/${identifier}`, {
+        headers: { Authorization: `Bearer ${VALID_TOKEN}` }
+      })
+      expect(response.status).toBe(422)
+      await expect(response.json()).resolves.toMatchObject({ status: 422 })
+      expect(provider).not.toHaveBeenCalled()
+    }
+  )
+
   it.each(['Basic xxx', 'Bearer', 'bearer xxx', 'Bearer    xxx', 'xxx'])(
     'rejects the invalid Authorization format %s',
     async (authorization) => {