修复附件询价：公网打开上传页不再出骨架 JSON，未上传时打字能正常回话。

Co-authored-by: Cursor <cursoragent@cursor.com>

inquiry-agent/tests/test_attachment_upload_h5.py

@@ -66,6 +66,30 @@ class AttachmentUploadH5Tests(unittest.TestCase):
         self.assertEqual(miss.status_code, 410)
         self.assertIn("过期", miss.text)
 
+    def test_bare_token_opens_upload_page_not_json(self) -> None:
+        """
+        公网 Nginx 会把 /inquiry-form/upload/{token} 改写成 /inquiry-form/{token}。
+        附件票必须出上传页，不能把补问骨架 JSON 直接给销售。
+        """
+        token = self._open_card()
+        hit = self.client.get(f"/inquiry-form/{token}")
+        self.assertEqual(hit.status_code, 200)
+        self.assertIn("text/html", hit.headers.get("content-type", ""))
+        self.assertIn("Excel", hit.text)
+        self.assertNotIn("骨架", hit.text)
+        self.assertNotIn("s1", hit.text)
+        miss = self.client.get("/inquiry-form/not-a-real-token")
+        self.assertIn(miss.status_code, (410, 422))
+
+    def test_bare_token_post_png_rejected(self) -> None:
+        token = self._open_card()
+        hit = self.client.post(
+            f"/inquiry-form/{token}",
+            files=[("files", ("shot.png", b"\x89PNG", "image/png"))],
+        )
+        self.assertEqual(hit.status_code, 400)
+        self.assertIn("Excel", hit.text)
+
     def test_upload_page_uses_card_chrome(self) -> None:
         from agent.channel.h5.upload_page import expired_upload_page, render_upload_message, render_upload_page