fix(case): require project scope for uploads

backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java

@@ -339,7 +339,11 @@ public class AihrCaseService {
 
     private String resolveUploadProject(String requestedProject, List<String> projectScopes) {
         if (projectScopes == null) {
-            return firstNonBlank(requestedProject, "");
+            String project = clean(requestedProject);
+            if (project.isBlank()) {
+                throw new IllegalArgumentException("系统用户上传案例必须明确所属项目");
+            }
+            return project;
         }
         if (projectScopes.isEmpty()) {
             throw new IllegalArgumentException("当前账号没有可用项目身份，暂不能提交案例");

backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrCaseServiceTest.java

@@ -15,6 +15,7 @@ import java.util.Optional;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
@@ -82,6 +83,16 @@ class AihrCaseServiceTest {
         assertTrue(AihrCaseService.caseProjectAllowed("P1", null));
     }
 
+    @Test
+    @Tag("dev")
+    void systemUploadRequiresExplicitProject() {
+        AihrCaseService service = new AihrCaseService(null, null, new ObjectMapper(), new CaseJdbcTemplate());
+
+        assertThrows(IllegalArgumentException.class, () -> service.upload(
+            new MockMultipartFile("file", "case.webm", "audio/webm", new byte[]{1}), "", null
+        ));
+    }
+
     @Test
     @Tag("dev")
     void caseContributorPositionRecognizesProjectManagersAndLeads() {