feat: strengthen P0 security and operations

Tiku.Infrastructure/Storage/AliyunOssObjectStorageService.cs

@@ -1,4 +1,5 @@
 using System.Reflection;
+using System.Net;
 using System.Security.Cryptography;
 using System.Text.RegularExpressions;
 using AlibabaCloud.OSS.V2.Credentials;
@@ -386,6 +387,33 @@ public sealed partial class AliyunOssObjectStorageService(
             "aliyun-oss-put-object");
     }
 
+    public async Task<Stream> OpenReadAsync(
+        ObjectStorageReadRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        var provider = NormalizeProvider(request.Provider);
+        var objectKey = ValidateObjectKey(request.TenantId, request.ObjectKey);
+        if (provider != ObjectStorageProviders.AliyunOss)
+        {
+            throw new ObjectStorageException(
+                $"{provider} does not support managed server-side reads.",
+                "READ_PROVIDER_NOT_SUPPORTED");
+        }
+        if (string.IsNullOrWhiteSpace(request.Bucket))
+        {
+            throw new ObjectStorageException("Aliyun OSS asset requires bucket.", "ASSET_OBJECT_LOCATION_REQUIRED");
+        }
+
+        var result = await GetClient().GetObjectAsync(
+            new GetObjectRequest { Bucket = request.Bucket, Key = objectKey },
+            HttpCompletionOption.ResponseHeadersRead,
+            null,
+            cancellationToken);
+        return result.Body ?? throw new ObjectStorageException(
+            "Object storage returned an empty response stream.",
+            "STORAGE_OBJECT_EMPTY_RESPONSE");
+    }
+
     public void Dispose()
     {
         if (disposed)