feat: SDK 类型化门面接入（flow/cms 走服务目录）+ 教师组科室语义对齐 + F1-F3 存量

- FlowCenterClient/CmsSiteDirectoryImpl：服务目录命名目标（flowcenter/cms）优先，
  legacy svchall.flow/cms.base-url 回落（迁移期兼容）
- SvcModels.FlowSummaryVo extends SDK FlowDto（单一事实源）
- 含 2026-09-13/14 存量：bizUrl hash-query(F1)/IDHttp ctx 签名/apply 漏 schId/回填事务

src/test/java/com/yunhai/svchall/service/impl/CmsSiteDirectoryImplTest.java

@@ -8,6 +8,7 @@ import com.yunhai.svchall.service.SiteDirectory;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
 
 import java.util.Arrays;
 import java.util.Collections;
@@ -139,4 +140,21 @@ class CmsSiteDirectoryImplTest {
         assertTrue(brief.contains("ConnectException"), brief);
         assertTrue(brief.contains("Connection refused: connect"), brief);
     }
+
+    @Test
+    @DisplayName("基址拆解：带端口 + context-path 的部署态基址必须原样保留端口，ctx 作 basePath（签名剥离用）")
+    void baseUrl_splitKeepsPortAndContextPath() {
+        ArgumentCaptor<TargetSpec> captor = ArgumentCaptor.forClass(TargetSpec.class);
+        YschOpenCall call = mock(YschOpenCall.class);
+        when(call.getList(captor.capture(), eq(PATH), eq(Collections.singletonMap("schId", "3")), eq(VO_TYPE)))
+                .thenReturn(Collections.emptyList());
+
+        new CmsSiteDirectoryImpl(call, "http://base.yunhaixingtong.com:10005/yschcms/").listSites(3L);
+
+        TargetSpec spec = captor.getValue();
+        // 丢端口会连不上（Caddy 只反代 /yschcms/{front,api,portal}，/oapi 只能走容器端口）
+        assertEquals("http://base.yunhaixingtong.com:10005/yschcms", spec.resolveBaseUrl());
+        // ctx 必须进 basePath，否则签名 target 与服务端剥掉 ctx 后不一致 → 401
+        assertEquals("/yschcms", spec.getBasePath());
+    }
 }