REENCODE_EXTENSIONS
REENCODE_EXTENSIONS = ['jpg', 'jpeg', 'png', 'webp', 'bmp']
可 GD 重编码的图片扩展（gif 动图丢帧不重编码；svg 不在上传白名单内）
上传文件净化与图片多规格（用户上传安全体系）。
职责：对上传文件做「内容级」安全处理——不信任扩展名，只信实际内容：
┌────────────────── 分区导航（按此顺序阅读）──────────────────┐ 分区 1 · 安全白名单常量 REENCODE_EXTENSIONS / EXT_MIME 分区 2 · 构造注入 __construct 分区 3 · 魔数校验 isImage / verifyMime 分区 4 · 净化与缩略图 sanitizeImage / thumbnail └────────────────────────────────────────────────────────────┘
EXT_MIME = ['jpg' => ['image/jpeg'], 'jpeg' => ['image/jpeg'], 'png' => ['image/png'], 'gif' => ['image/gif'], 'webp' => ['image/webp'], 'bmp' => ['image/bmp', 'image/x-ms-bmp'], 'pdf' => ['application/pdf'], 'txt' => ['text/plain'], 'csv' => ['text/plain', 'text/csv', 'application/csv'], 'json' => ['application/json', 'text/plain'], 'log' => ['text/plain'], 'ini' => ['text/plain'], 'yaml' => ['text/plain'], 'yml' => ['text/plain'], 'conf' => ['text/plain'], 'zip' => ['application/zip', 'application/x-zip-compressed'], 'rar' => ['application/vnd.rar', 'application/x-rar-compressed', 'application/octet-stream'], '7z' => ['application/x-7z-compressed', 'application/octet-stream'], 'tar' => ['application/x-tar', 'application/octet-stream'], 'gz' => ['application/gzip', 'application/x-gzip', 'application/octet-stream'], 'doc' => ['application/msword'], 'docx' => ['application/vnd.openxmlformats-officedocument.wordprocessingml.document', 'application/zip'], 'ppt' => ['application/vnd.ms-powerpoint'], 'pptx' => ['application/vnd.openxmlformats-officedocument.presentationml.presentation', 'application/zip'], 'xls' => ['application/vnd.ms-excel'], 'xlsx' => ['application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', 'application/zip'], 'mp4' => ['video/mp4'], 'webm' => ['video/webm'], 'mov' => ['video/quicktime'], 'avi' => ['video/x-msvideo', 'video/avi'], 'wmv' => ['video/x-ms-wmv', 'application/octet-stream'], 'asf' => ['application/octet-stream', 'video/x-ms-asf'], 'flv' => ['video/x-flv', 'application/octet-stream'], 'rm' => ['application/octet-stream', 'application/vnd.rn-realmedia'], 'rmvb' => ['application/octet-stream'], 'mp3' => ['audio/mpeg', 'audio/mp3'], 'wav' => ['audio/wav', 'audio/x-wav', 'audio/wave'], 'epub' => ['application/epub+zip', 'application/zip'], 'mobi' => ['application/x-mobipocket-ebook', 'application/octet-stream'], 'ttf' => ['font/ttf', 'application/x-font-ttf', 'application/octet-stream'], 'otf' => ['font/otf', 'application/octet-stream'], 'woff' => ['font/woff', 'application/octet-stream'], 'woff2' => ['font/woff2', 'application/octet-stream']] : array<string,string[]>
扩展名 → 允许的实际 MIME（finfo 可靠域严格；视频/音频/字体 finfo 常回 octet-stream 放宽； OOXML 三件套与 epub 是 zip 容器，额外接受 application/zip）。
白名单理由：扩展名是用户可控的，攻击者可把脚本/载荷改名成 .jpg 上传； 用 finfo 读实际内容类型并与「该扩展名允许的真实类型」白名单比对， 才能拦截伪造扩展与多态载荷（一个文件既是合法图片又是可执行脚本）。
$config : \App\Services\Admin\ConfigService