review fix: 独立h5-manifest + 域名校验 + 恢复APK manifest

- ota/h5/manifest-{channel}.json — 独立于APK manifest
- ota/manifest-*.json — 恢复gen-manifest.sh格式
- v6 HTML: h5_sha256缺失拒绝 + h5_url域名校验

ota/h5/index-v6.html

@@ -44,13 +44,14 @@ function selectCh(el,ch){
 }
 function log(m){document.getElementById('log').innerText+=m+'\n'}
 function checkUpdate(){
- var manFile='/manifest-'+channel+'.json';
+ var manFile='/h5/manifest-'+channel+'.json';
  log('checking '+manFile+' ...');
  fetch(BASE+manFile+'?t='+Date.now(),{cache:'no-store'})
  .then(function(r){if(!r.ok)throw Error('HTTP '+r.status);return r.json()})
  .then(function(j){log('remote: '+j.h5_version);
   dlUrl=j.h5_url;dlSha=j.h5_sha256||'';
-  if(!dlUrl){log('ERR: no h5_url');return}
+  if(!dlSha){log('ERR: manifest missing h5_sha256');return}
+  if(!dlUrl||dlUrl.indexOf(BASE)!==0){log('ERR: invalid h5_url domain');return}
   if(j.h5_version!=='0.1.0-dav-android-6'){dlVer=j.h5_version;
    log('*** NEW VERSION ***');document.getElementById('btnApply').disabled=false}
   else log('up to date')})