feat(oapi): 办件进度/流程图token出图/托管撤回 + CAS直嵌示意图（两会话产物合入）

src/main/java/com/yunhai/flowcenter/controller/api/FlowUserController.java

@@ -13,6 +13,8 @@ import com.yunhai.platform.utils.exception.ErrorCode;
 import com.yunhai.platform.utils.model.BasePageResult;
 import com.yunhai.platform.utils.model.BoaUser;
 import lombok.RequiredArgsConstructor;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -37,6 +39,7 @@ public class FlowUserController {
     private final FlowInstanceService instanceService;
     private final FlowAccessGuard accessGuard;
     private final FlowDiagramService diagramService;
+    private final com.yunhai.flowcenter.service.DiagramImageService imageService;
 
     /** 我提交的办件 */
     @GetMapping("/my")
@@ -155,6 +158,23 @@ public class FlowUserController {
         throw new BizException(ErrorCode.PARAM_ERROR, "缺少必要参数：flowGuid 或 instanceId");
     }
 
+    /**
+     * 流程图图片流（CAS 会话版"CAS 验证码式嵌入"，2026-09-16）：流程中心自有页面 <img src>
+     * 直嵌（办件详情页内嵌运行时状态图），免跳 /diagram 全屏页。可见性与 /diagram 同口径。
+     * 外部系统（img 带不了会话）走 /oapi/flow/diagram/url 换 token + /open/flow/diagram/img。
+     */
+    @GetMapping("/diagram.png")
+    public ResponseEntity<byte[]> diagramPng(BoaUser user,
+                                             @RequestParam(value = "flowGuid", required = false) String flowGuid,
+                                             @RequestParam(value = "instanceId", required = false) Long instanceId,
+                                             @RequestParam(value = "mode", required = false) String mode) {
+        FlowModels.DiagramVo vo = diagram(user, flowGuid, instanceId, mode);
+        return ResponseEntity.ok()
+                .contentType(MediaType.IMAGE_PNG)
+                .cacheControl(org.springframework.http.CacheControl.noStore())
+                .body(imageService.renderPng(vo));
+    }
+
     private Long requireSchId(BoaUser user) {
         if (user == null) {
             throw new BizException(ErrorCode.FORBIDDEN, "未登录");