test: 提升Web包测试覆盖率 - 新增UrlValidator边界测试

新增测试：
- UserExperienceController: maskPhone方法测试
- UrlValidator: IPv6公网地址、0.0.0.0地址、无效主机名、URI异常处理

覆盖率提升：
- 总体分支: 63.6% → 63.8% (+1个分支)
- Web包: 78% → 79% (+1%)
- 新增测试: 5个
- 距离70%目标: 还需39个分支

累计成果（本次会话）：
- 新增测试: 17个
- 分支覆盖: +8个 (404→412)
- Controller包: 73% → 89% (+16%)
- Web包: 78% → 79% (+1%)

src/test/java/com/mosquito/project/controller/UserExperienceControllerTest.java

@@ -310,4 +310,21 @@ class UserExperienceControllerTest {
             .andExpect(jsonPath("$.code").value(200))
             .andExpect(jsonPath("$.data[0].type").value("points"));
     }
+
+    @Test
+    void shouldMaskPhoneNumber_inInvitedFriends() throws Exception {
+        UserInviteEntity a = new UserInviteEntity();
+        a.setInviteeUserId(123L);
+        a.setStatus("registered");
+        when(userInviteRepository.findByActivityIdAndInviterUserId(anyLong(), anyLong())).thenReturn(List.of(a));
+
+        mockMvc.perform(get("/api/v1/me/invited-friends")
+                .param("activityId", "1")
+                .param("userId", "2")
+                .header("X-API-Key", TestAuthSupport.RAW_API_KEY)
+                .header("Authorization", "Bearer test-token"))
+            .andExpect(status().isOk())
+            .andExpect(jsonPath("$.code").value(200))
+            .andExpect(jsonPath("$.data[0].maskedPhone").value("138****0123"));
+    }
 }

src/test/java/com/mosquito/project/web/UrlValidatorTest.java

@@ -161,4 +161,31 @@ class UrlValidatorTest {
         assertThat(urlValidator.isAllowedUrl("http://[::1]")).isFalse();
         assertThat(urlValidator.isAllowedUrl("http://[0:0:0:0:0:0:0:1]")).isFalse();
     }
+
+    @Test
+    @DisplayName("应该接受IPv6公网地址")
+    void shouldAcceptPublicIpv6Address() {
+        // 使用Google的公网IPv6地址
+        assertThat(urlValidator.isAllowedUrl("http://[2001:4860:4860::8888]")).isTrue();
+    }
+
+    @Test
+    @DisplayName("应该拒绝0.0.0.0地址")
+    void shouldRejectZeroAddress() {
+        assertThat(urlValidator.isAllowedUrl("http://0.0.0.0")).isFalse();
+        assertThat(urlValidator.isAllowedUrl("http://0.0.0.0:8080")).isFalse();
+    }
+
+    @Test
+    @DisplayName("应该处理无效主机名")
+    void shouldHandleInvalidHostname() {
+        assertThat(urlValidator.isAllowedUrl("http://invalid..hostname")).isFalse();
+        assertThat(urlValidator.isAllowedUrl("http://-invalid-hostname")).isFalse();
+    }
+
+    @Test
+    @DisplayName("sanitizeUrl应该处理URISyntaxException")
+    void shouldHandleUriSyntaxExceptionInSanitize() {
+        assertThat(urlValidator.sanitizeUrl("http://invalid url with spaces")).isNull();
+    }
 }