fix(web): always drain visit request body to keep keep-alive connections aligned

tests/test_web_server.py

@@ -270,6 +270,33 @@ def test_visit_endpoint_and_stats():
             running.close()
 
 
+def test_visit_query_path_drains_body():
+    """path 也可来自查询串；请求体必须被读走，避免 keep-alive 连接错位。"""
+    with tempfile.TemporaryDirectory() as tmp:
+        running = RunningServer(tmp)
+        try:
+            ua = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/155.0"}
+            conn = http.client.HTTPConnection("127.0.0.1", running.port, timeout=5)
+            conn.request(
+                "POST", "/api/visit?path=/about",
+                body=json.dumps({"path": "/ignored"}),
+                headers={**ua, "Content-Type": "application/json"},
+            )
+            first = conn.getresponse()
+            first_payload = json.loads(first.read())
+            assert first.status == 200
+            assert first_payload["data"]["route"] == "/about"
+
+            # 同一连接继续发请求：若上一次请求体未被读走，这里会解析错位
+            conn.request("GET", "/api/health")
+            second = conn.getresponse()
+            health = json.loads(second.read())
+            conn.close()
+            assert second.status == 200 and health["ok"] is True
+        finally:
+            running.close()
+
+
 def test_token_auth_and_login():
     with tempfile.TemporaryDirectory() as tmp:
         running = RunningServer(tmp, token="test-token")
@@ -385,6 +412,7 @@ def test_preview_and_loopback_guards():
 def main_test():
     test_readonly_routes_and_static()
     test_visit_endpoint_and_stats()
+    test_visit_query_path_drains_body()
     test_token_auth_and_login()
     test_preview_and_loopback_guards()
     print("OK: Web 只读路由/鉴权/预览/访问统计/安全边界测试全部通过")