feat(platform): expose multi-source vehicle evidence

vehicle-data-platform/docs/deployment.md

@@ -205,6 +205,8 @@ curl -fsS -H "$AUTH_HEADER" -H 'Content-Type: application/json' \
   -d '{"keyword":"LNXNEGRR7SR318212","status":"active","limit":20,"offset":0}' \
   http://127.0.0.1:20300/api/v2/alerts/events
 curl -fsS -H "$AUTH_HEADER" http://127.0.0.1:20300/api/v2/vehicles/LNXNEGRR7SR318212/telemetry/latest
+curl -fsS -H "$AUTH_HEADER" \
+  'http://127.0.0.1:20300/api/v2/vehicles/LNXNEGRR7SR318212/source-evidence?date=2026-07-16'
 curl -fsS -H "$AUTH_HEADER" 'http://127.0.0.1:20300/api/vehicles?limit=5'
 curl -fsS -H "$AUTH_HEADER" \
   'http://127.0.0.1:20300/api/v2/history/series?keyword=LNXNEGRR7SR318212&dateFrom=2026-07-14T00%3A00&dateTo=2026-07-14T06%3A00&targetPoints=240'
@@ -237,6 +239,8 @@ Track smoke must also select the final playback event and verify synchronized SO
 
 Global-monitor smoke must verify `zoom=5` returns clusters, a city `bounds` at `zoom=13` returns at most 2,000 lightweight points, and invalid/reversed bounds return HTTP 400. In the browser, the rail renders at most 200 vehicle rows while the legend reports the independent map mode. Selecting `driving` or `idle` must constrain both the server-side count and every loaded row. A unique keyword result must discard the previous viewport and focus at point zoom. The synthetic release gate is `go test ./internal/platform -run TestMonitorMapTenThousandVehicles -count=1` plus `go test ./internal/platform -run '^$' -bench BenchmarkMonitorMapTenThousandVehicles -benchtime=30x -benchmem`.
 
+Source-evidence smoke must use a vehicle with at least two protocols and a vehicle with more than one JT808 terminal. Verify that the response returns every actual location/mileage candidate, exactly one current recommendation, protocol-internal selection, availability/quality state and cross-source differences. Raw `source_key`, source IP, endpoint, phone and device identifiers must not appear; terminal labels must remain masked. The browser must not call this endpoint before the operator expands coordinates or mileage. Production baseline for `沪A35898F` on 2026-07-16 returned two JT808 terminals with one recommendation; 20 sequential requests had a 26.6ms median and 29.1ms P95.
+
 Latest-telemetry smoke must use an actively reporting VIN and verify that populated categories exactly sum to `values.length`, catalog-mapped values retain both the unified `key` and exact `sourceField`, every value has frame/time/protocol evidence, and the quality reason agrees with freshness and parser status. `scannedFrames` must remain at or below 15: the implementation resolves identity once, queries the three supported protocol tables concurrently with five rows each, and never runs a pagination count. The browser must display source, compact device time and quality without deriving labels, units or categories from RAW keys. The bounded synthetic gate is `go test ./internal/platform -run 'TestBuildLatestTelemetryResponse|TestLatestTelemetryQuality|TestLatestTelemetryBoundsProtocolReads' -count=1` plus `go test ./internal/platform -run '^$' -bench BenchmarkLatestTelemetryHundredFrames -benchmem`.
 
 Alert evaluation is intentionally not exposed as an HTTP route because it mutates candidate/event state. Production evaluation is owned by the evaluator unit. Confirm its `rules/vehicles/candidates_advanced/duplicate_observations/late_observations/stale_evidence_skipped/opened/recovered` log line and verify the resulting event through the read APIs. A release gate with an active scoped rule must survive at least one persisted candidate reload and one persisted last-trigger reload; MySQL `DATETIME(3)` values are scanned directly as times so millisecond values are never forced through an integer `UNIX_TIMESTAMP` conversion.

vehicle-data-platform/docs/vehicle-data-platform-meeting-todo.md

@@ -4,6 +4,13 @@
 
 唯一会议依据：`张兰发起的视频会议_0716.txt`
 
+来源校验：
+
+- 原文件：`/Users/lingniu/Library/Mobile Documents/com~apple~CloudDocs/rsync/张兰发起的视频会议_0716.txt`
+- 文件修改时间：`2026-07-16 15:16:16 +0800`
+- 文件大小：43,820 字节，共 1,259 行
+- SHA-256：`57f34ac130ec5a96d9d7929df4977acad50b5aeeae869f864c77bf99017063c3`
+
 当前项目：`vehicle-data-platform`
 
 ## 1. 范围与执行原则
@@ -121,7 +128,18 @@
 
 ### P0-03 位置与里程的多来源展开
 
-状态：`进行中`
+状态：`已完成`
+
+已上线结果（release `source-evidence-scope-20260716163402`）：
+
+- 新增按车辆、日期读取全部位置与里程来源的受 Scope 保护接口；只有用户主动展开后才请求，不参与列表、地图初始化或定时车队刷新。
+- 全局监控和单车详情均可点击坐标、总里程、当日里程，或使用“查看全部来源”按钮展开。
+- 同一协议多终端独立展示来源平台、脱敏终端、协议内选中、当前推荐、启停、在线和质量状态。
+- 位置卡片展示坐标、速度、总里程、SOC、设备时间和接收时间；里程卡片展示首末总里程、日里程、样本数和首末时间。
+- 自动计算最大位置差、总里程差、当日里程差和上报时间差；展开只解释后台选举，不改变原始证据。
+- 生产真实车辆 `沪A35898F` 验证可同时展示赛格和 G7s 两个 JT808 终端，并仅推荐其中一个；20 次接口请求中位约 26.6ms、P95 约 29.1ms。
+- 终端手机号/设备号在服务端脱敏，响应不返回原始 `source_key`、来源 IP 或端点。
+- 客户查询历史日期时继续执行车辆授权时间边界：授权首日/结束日不是完整自然日时不返回该日的来源里程证据。
 
 目标：