fix(share): harden story share and relocate import button

- Add Content-Length pre-check to story-pack and story-unpack routes
  to reject oversized payloads before buffering the body
- Suppress internal error details in story-unpack catch (was leaking
  e.message to the client)
- Strengthen sceneIndex validation: require non-negative integer
- Guard against undefined storyState when replaying shared stories
- Fix prefetch regression: remove currentBeat?.id from useEffect deps
  that was re-triggering all change-scene prefetches on every beat
- Fix double detach: use else-if so the second replay detach guard
  doesn't fire redundantly after the first already detached
- Align client file-size limit by format (.json 12MB, .infiplot 13MB)
- Move "载入剧情" import button next to "开始" with hover tooltip

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/api/story-pack/route.ts

@@ -13,6 +13,14 @@ export async function POST(req: Request): Promise<Response> {
     );
   }
 
+  const contentLength = req.headers.get("content-length");
+  if (contentLength && Number(contentLength) > MAX_DOC_BYTES + 1024) {
+    return Response.json(
+      { error: "剧情数据太大,无法打包分享" },
+      { status: 413 },
+    );
+  }
+
   let docStr: string;
   try {
     const body = (await req.json()) as { docStr?: unknown };

app/api/story-unpack/route.ts

@@ -13,6 +13,11 @@ export async function POST(req: Request): Promise<Response> {
     );
   }
 
+  const contentLength = req.headers.get("content-length");
+  if (contentLength && Number(contentLength) > MAX_FILE_BYTES) {
+    return Response.json({ error: "文件太大" }, { status: 413 });
+  }
+
   let ab: ArrayBuffer;
   try {
     ab = await req.arrayBuffer();
@@ -29,9 +34,9 @@ export async function POST(req: Request): Promise<Response> {
   try {
     const docStr = await unpackDoc(new Uint8Array(ab), secret);
     return Response.json({ docStr });
-  } catch (e) {
+  } catch {
     return Response.json(
-      { error: e instanceof Error ? e.message : "解包失败" },
+      { error: "剧情文件解包失败" },
       { status: 400 },
     );
   }