issue: Generated task artifacts and task message logs are exposed without authentication

[yomo40]

The backend attaches the entire project/work_dir to /static; /download_url and /download_all_url directly return static download links; /messages reads the message log file as long as the task_id is provided. There is no user authentication or task attribution verification in the code.

Caution

Anyone who knows or guesses the task_id can read the generated papers, data products, and log messages. If the logs or products contain sensitive data, it will constitute unauthorized access.