feat(platform): consolidate production vehicle data workflows

vehicle-data-platform/apps/api/internal/app/server.go

@@ -88,8 +88,10 @@ func NewServer(cfg config.Config) http.Handler {
 			httpx.WriteError(w, http.StatusServiceUnavailable, "DATA_STORE_UNAVAILABLE", "生产数据源不可用", storeErr.Error(), requestTraceID(r))
 		})
 	}
+	// Reverse geocoding consumes the server-side AMap credential, so it must
+	// stay behind the same authentication boundary as the platform API.
+	api = withAMapReverseGeocodeAPI(api, cfg, "https://restapi.amap.com", http.DefaultClient)
 	handler := static.Handler(cfg.StaticDir, withAPIAuth(api, cfg))
-	handler = withAMapReverseGeocodeAPI(handler, cfg, "https://restapi.amap.com", http.DefaultClient)
 	handler = withAppConfig(handler, cfg)
 	handler = withAMapSecurityProxy(handler, cfg, defaultAMapProxyUpstreams(), http.DefaultClient)
 	return withRequestTimeout(handler, cfg.RequestTimeout)

vehicle-data-platform/apps/api/internal/app/server_test.go

@@ -256,3 +256,21 @@ func TestAMapReverseGeocodeAPIRejectsBadCoordinate(t *testing.T) {
 		t.Fatalf("body should mention bad coordinate: %s", rec.Body.String())
 	}
 }
+
+func TestServerRequiresAuthenticationForAMapReverseGeocode(t *testing.T) {
+	handler := NewServer(config.Config{
+		AuthMode:       "enforce",
+		AuthTokensJSON: `[{"token":"0123456789abcdef","name":"test-viewer","role":"viewer"}]`,
+		DataMode:       "mock",
+		AMapAPIKey:     "server-api-key",
+		RequestTimeout: time.Second,
+	})
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodGet, "/api/map/reverse-geocode?longitude=121.47&latitude=31.23", nil)
+
+	handler.ServeHTTP(recorder, request)
+
+	if recorder.Code != http.StatusUnauthorized {
+		t.Fatalf("anonymous reverse geocode status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+}