fix: close inbound hold bypass paths

firstleg/src/main/resources/openapi/firstleg-v1.yaml

@@ -44,6 +44,34 @@ paths:
             schema: {$ref: '#/components/schemas/InboundHoldCommand'}
       responses:
         '200': {description: 成功或完全同参幂等重放时 data 为 InboundHoldDetail；版本、状态、异参重放或实物作业冲突时响应体 code=A0409}
+  /api/platform/inbounds/{inboundId}/hold/evidence:
+    post:
+      summary: 上传扣货或解除凭证
+      description: 需要 platform:firstleg:inbound:hold；文件按明确客户和入库单归属保存，单文件最大 10MiB。
+      parameters:
+        - {name: inboundId, in: path, required: true, schema: {type: string, pattern: '^[1-9][0-9]*$'}}
+        - {name: tenantId, in: query, required: true, schema: {type: string, pattern: '^[1-9][0-9]*$'}}
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              required: [file]
+              properties:
+                file: {type: string, format: binary}
+      responses:
+        '200': {description: 成功时 data 为 InboundHoldEvidenceFile；入库单已发生实物作业时响应体 code=A0409}
+  /api/platform/inbounds/{inboundId}/hold/evidence/{fileId}/download:
+    get:
+      summary: 下载已关联扣货凭证
+      description: 需要 platform:firstleg:inbound:list；只允许下载已进入当前入库单不可变扣货历史的精确文件。
+      parameters:
+        - {name: inboundId, in: path, required: true, schema: {type: string, pattern: '^[1-9][0-9]*$'}}
+        - {name: fileId, in: path, required: true, schema: {type: string, pattern: '^[1-9][0-9]*$'}}
+        - {name: tenantId, in: query, required: true, schema: {type: string, pattern: '^[1-9][0-9]*$'}}
+      responses:
+        '200': {description: 附件二进制；未关联当前入库单或归属不匹配时响应体 code=A0404}
   /api/merchant/v1/first-leg/inbounds/{inboundId}/carton-label-pdf:
     post:
       summary: 客户端生成本客户入库单箱唛 PDF
@@ -1262,7 +1290,15 @@ components:
       properties:
         expectedVersion: {type: integer, minimum: 0, description: 当前入库聚合 version；成功后递增 1}
         reason: {type: string, minLength: 1, maxLength: 1000}
-        evidenceFileId: {type: integer, format: int64, minimum: 1, nullable: true, description: 可选的既有证据文件引用；本接口不上传文件}
+        evidenceFileId: {type: integer, format: int64, minimum: 1, nullable: true, description: 可选的 INBOUND_HOLD_EVIDENCE 文件引用，必须归属当前客户和入库单}
+    InboundHoldEvidenceFile:
+      type: object
+      required: [fileId, fileName, contentType, sizeBytes]
+      properties:
+        fileId: {type: integer, format: int64}
+        fileName: {type: string}
+        contentType: {type: string}
+        sizeBytes: {type: integer, format: int64, minimum: 0}
     InboundHoldHistoryItem:
       type: object
       required: [id, action, reason, operatedAt]