feat: 接入可选字体包同源渲染链

apps/desktop/tests/pdf-contract.test.ts

@@ -10,6 +10,7 @@ import {
 } from "../src/pdf-contract.js";
 import {
   parseMarkdownRenderRequest,
+  parseFontPackResourceUrl,
   parseThemeId,
   parseThemeResourceUrl
 } from "../src/application-contract.js";
@@ -105,6 +106,12 @@ describe("桌面 PDF 网络边界", () => {
         renderUrl
       )
     ).toBe(true);
+    expect(
+      isAllowedPdfRuntimeUrl(
+        "mdpdf://font-pack/official-cjk/1.0.0/serif/web?v=abc",
+        renderUrl
+      )
+    ).toBe(true);
   });
 
   it("拒绝外部网络资源", () => {
@@ -143,4 +150,22 @@ describe("桌面应用服务 IPC 载荷", () => {
       parseThemeResourceUrl("mdpdf://bundle/index.html")
     ).toBeUndefined();
   });
+
+  it("只接受字体包 Web 资源地址", () => {
+    expect(
+      parseFontPackResourceUrl(
+        "mdpdf://font-pack/official-cjk/1.0.0/serif-regular/web?v=abc"
+      )
+    ).toEqual({
+      packId: "official-cjk",
+      packVersion: "1.0.0",
+      faceId: "serif-regular",
+      kind: "web"
+    });
+    expect(() =>
+      parseFontPackResourceUrl(
+        "mdpdf://font-pack/official-cjk/1.0.0/serif-regular/docx"
+      )
+    ).toThrow("字体包资源地址无效");
+  });
 });