feat(appearance): 开放接口 GET /oapi/appearance（生效值合成）+ 级联下沉 service（oapi 代理轮）

- 新增 controller/oapi/OapiAppearanceController：userId 入参，出参 {theme, avatar, logoUrl} 当前用户生效值
  （个人→学校→平台级联合成，层级知识不外露）；出参裸 payload，Map 禁 String
- readThemeWithFallback/readAvatarWithFallback 从 SchSettingsController 下沉 ISchSettingsService（行为等价），
  供 schTheme 读端点与 oapi 合成共享——顺带修复「appearance 无学校→平台级联」审计缺陷 C
- OpenApiAuthEnforceConfiguration：/oapi/* 强制应用签名（无签名 401，对齐 UserMsg/UserBase 同名配置）
- oapi schId 解析走本地 user_current_role（不引 identity 跨仓）；超管临时切校角色场景与 /api 版有差，登记偏差
- 单测：生效值合成 3 例（个人优先不触级联/级联命中/脏值+无角色落平台层），60/60 绿

src/main/java/com/yunhai/userhome/service/impl/SchSettingsServiceImpl.java

@@ -6,6 +6,7 @@ import com.yunhai.userhome.entity.UserCurrentRole;
 import com.yunhai.userhome.repository.SchSettingsRepository;
 import com.yunhai.userhome.service.ISchSettingsService;
 import com.yunhai.userhome.service.IUserCurrentRoleService;
+import com.yunhai.userhome.utils.ThemeCodec;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
@@ -74,4 +75,40 @@ public class SchSettingsServiceImpl implements ISchSettingsService {
                 .filter(schId -> schId != null && schId > 0)
                 .orElseGet(() -> resolveSchId(user));
     }
+
+    @Override
+    public ISchSettingsService.LayerValue readThemeWithFallback(Integer schId) {
+        String themeState = decodeTheme(schId);
+        if (themeState != null || schId == null || schId == ISchSettingsService.PLATFORM_SCH_ID) {
+            return new ISchSettingsService.LayerValue(themeState, schId);
+        }
+        return new ISchSettingsService.LayerValue(decodeTheme(ISchSettingsService.PLATFORM_SCH_ID),
+                ISchSettingsService.PLATFORM_SCH_ID);
+    }
+
+    @Override
+    public ISchSettingsService.LayerValue readAvatarWithFallback(Integer schId) {
+        String avatarStyle = readAvatarAt(schId);
+        if (avatarStyle != null || schId == null || schId == ISchSettingsService.PLATFORM_SCH_ID) {
+            return new ISchSettingsService.LayerValue(avatarStyle, schId);
+        }
+        return new ISchSettingsService.LayerValue(readAvatarAt(ISchSettingsService.PLATFORM_SCH_ID),
+                ISchSettingsService.PLATFORM_SCH_ID);
+    }
+
+    /** 原样读某层主题档并解码（查无行/旧格式/脏值 → null） */
+    private String decodeTheme(Integer schId) {
+        return schSettingsRepository.findFirstBySchId(schId)
+                .map(SchSettings::getThemeName)
+                .map(ThemeCodec::decodeThemeState)
+                .orElse(null);
+    }
+
+    /** 原样读某层头像样式（查无行/非法值 → null） */
+    private String readAvatarAt(Integer schId) {
+        return schSettingsRepository.findFirstBySchId(schId)
+                .map(SchSettings::getAvatarStyle)
+                .filter(ThemeCodec::isAvatarStyle)
+                .orElse(null);
+    }
 }