fix: close remaining Z39 slug isolation gaps

Bind preview rows and published API base paths to the active module slug so cloned or stale state cannot address another module.

Co-authored-by: Cursor <cursoragent@cursor.com>

platform/internal/logic/applogic/publish.go

@@ -186,9 +186,8 @@ func (l *PublishLogic) Publish(slug string, req *types.PublishReq) (*types.Publi
 	if slug != "" && slug != incoming.Meta.Slug {
 		incoming.Meta.Slug = slug
 	}
-	if incoming.Apis.BasePath == "" || strings.Contains(incoming.Apis.BasePath, "-") {
-		incoming.Apis.BasePath = "/api/v1/apps/" + slug
-	}
+	// Z39：API 地址只由本次发布路径 slug 决定，禁止克隆蓝图沿用旧模块 base_path。
+	incoming.Apis.BasePath = "/api/v1/apps/" + slug
 
 	mode := strings.ToLower(strings.TrimSpace(req.Mode))
 	if mode == "" {
@@ -568,9 +567,7 @@ func (l *PublishLogic) publishHostMetaOnly(
 	bp := existing.Blueprint
 	bp.Meta.Name = moduleName
 	bp.Meta.Slug = slug
-	if bp.Apis.BasePath == "" {
-		bp.Apis.BasePath = "/api/v1/apps/" + slug
-	}
+	bp.Apis.BasePath = "/api/v1/apps/" + slug
 
 	rec := existing
 	rec.Name = moduleName