storage: 对齐图片对象 key 到生产口径

生产真实 key 为 `YYYY/MM/<UnixNano>.<ext>`（无前缀、无 day 层），
与 route/question/page.go:uploadImage 一致；internal/storage 里三个
上传函数仍用旧的 `picture/ 前缀 + YYYY/MM/DD + 15hex + 无扩展名`，从未上线。

- PictureKeyPrefix 置空，统一由 uploadKey 生成 key
- 扩展名跟随最终 ContentType（webp 转成功用 .webp，回退原图用原格式）
- OSS 原图直传通道取原文件名扩展名
- 新增 picture_test.go 锁定 key 格式，防回归

internal/storage/oss.go

@@ -8,10 +8,8 @@ import (
 	"fmt"
 	"io"
 	"mime/multipart"
-	"time"
 
 	"github.com/pkg/errors"
-	"github.com/thanhpk/randstr"
 	"github.com/wuhan005/gadget"
 
 	"github.com/tamakyi/TamaBox/internal/conf"
@@ -19,7 +17,7 @@ import (
 
 // UploadPictureToOSS upload user's avatar or background image to OSS.
 // It returns the uploaded asset URL.
-func UploadPictureToOSS(file multipart.File, _ *multipart.FileHeader) (string, error) {
+func UploadPictureToOSS(file multipart.File, fileHeader *multipart.FileHeader) (string, error) {
 	// 读取文件头，校验是否为图片
 	header := make([]byte, 512)
 	n, err := file.Read(header)
@@ -43,12 +41,12 @@ func UploadPictureToOSS(file multipart.File, _ *multipart.FileHeader) (string, e
 		return "", errors.Wrap(err, "get OSS bucket")
 	}
 
-	now := time.Now()
-	year := now.Year()
-	month := int(now.Month())
-	day := now.Day()
-
-	key := fmt.Sprintf("%s%d/%02d/%02d/%s", PictureKeyPrefix, year, month, day, randstr.Hex(15))
+	// OSS 通道原样上传原图（不转 WebP），扩展名沿用原始文件名。
+	ext := ""
+	if fileHeader != nil {
+		ext = originalExt(fileHeader.Filename)
+	}
+	key := uploadKey(ext)
 
 	if err := gadget.Retry(5, func() error {
 		if err := bucket.PutObject(key, file); err != nil {