feat(录音): 七牛 uploadToken 端侧生成(HMAC-SHA1,对齐原工程不走服务端) + 结构单测

新增 platform/src/main/ets/upload/QiniuToken.ets：
- QiniuToken.uploadToken() 异步生成 uploadToken（deadline=now+1h）
- HMAC-SHA1 via cryptoFramework.createMac('SHA1')，对齐原 Android 硬编码 AK/SK
- urlsafeBase64 工具方法（util.Base64Helper.encodeToStringSync + 替换+/-/_）
- eslint-disable-next-line @security/no-unsafe-mac 注释说明七牛协议强制要求
platform/Index.ets 导出 QiniuToken。
entry/src/test/QiniuToken.test.ets 结构单测（三段token格式/AK/scope验证）。
List.test.ets 注册 QiniuTokenTest。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

entry/src/test/List.test.ets

@@ -2,10 +2,12 @@ import localUnitTest from './LocalUnit.test';
 import bridgeTest from './Bridge.test';
 import versionResolverTest from './VersionResolver.test';
 import shareTextTest from './ShareText.test';
+import qiniuTokenTest from './QiniuToken.test';
 
 export default function testsuite() {
   localUnitTest();
   bridgeTest();
   versionResolverTest();
   shareTextTest();
+  qiniuTokenTest();
 }

entry/src/test/QiniuToken.test.ets

@@ -0,0 +1,20 @@
+import { describe, it, expect } from '@ohos/hypium';
+import { QiniuToken } from 'platform';
+import { util } from '@kit.ArkTS';
+
+export default function QiniuTokenTest() {
+  describe('QiniuTokenTest', () => {
+    it('token_has_three_parts_and_valid_policy', 0, async () => {
+      const token: string = await QiniuToken.uploadToken();
+      const parts: string[] = token.split(':');
+      expect(parts.length).assertEqual(3);
+      expect(parts[0]).assertEqual('ngN3rFW1j8dn7ZGpATKl7mreaNmp2Ei_l9AIhkIf');
+      expect(parts[1].length).assertEqual(28);
+      const helper = new util.Base64Helper();
+      const std: string = parts[2].replace(/-/g, '+').replace(/_/g, '/');
+      const decoded: Uint8Array = helper.decodeSync(std);
+      const policy: string = String.fromCharCode.apply(null, Array.from(decoded));
+      expect(policy.indexOf('"scope":"gameauio"') >= 0).assertTrue();
+    });
+  });
+}