fix(update-service): 非灰度版本对匿名用户可见

原逻辑在 allowAnonymousCheck=false 且 userId=null 时直接返回
needsUpdate=false，导致无登录流程的应用（如 clinical-android）
永远收不到更新提示。

修正为：只有灰度版本才需要 userId；非灰度已发布版本对所有调用
方可见，allowAnonymousCheck=false 仅在非灰度场景下补充拦截。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

update-service/src/main/java/com/xuqm/update/controller/AppVersionController.java

@@ -58,9 +58,6 @@ public class AppVersionController {
             @RequestParam(required = false) String userId) {
 
         boolean allowAnonymousCheck = publishConfigService.allowAnonymousUpdateCheck(appKey);
-        if (!allowAnonymousCheck && (userId == null || userId.isBlank())) {
-            return ResponseEntity.ok(ApiResponse.success(Map.of("needsUpdate", false)));
-        }
 
         Optional<AppVersionEntity> latest = versionRepository
                 .findTopByAppKeyAndPlatformAndPublishStatusAndVersionCodeGreaterThanOrderByVersionCodeDesc(
@@ -75,12 +72,21 @@ public class AppVersionController {
 
         AppVersionEntity v = latest.get();
 
-        // Gray release filtering
+        // Gray release: userId is required when anonymous checks are disabled and version is gray-targeted.
-        if (!allowAnonymousCheck && v.isGrayEnabled() && userId != null && !userId.isBlank()) {
+        // Non-gray published versions are visible to all callers regardless of userId.
-            boolean inGray = isInGrayRelease(v, userId);
+        if (v.isGrayEnabled()) {
-            if (!inGray) {
+            if (!allowAnonymousCheck && (userId == null || userId.isBlank())) {
                 return ResponseEntity.ok(ApiResponse.success(Map.of("needsUpdate", false)));
             }
+            if (userId != null && !userId.isBlank()) {
+                boolean inGray = isInGrayRelease(v, userId);
+                if (!inGray) {
+                    return ResponseEntity.ok(ApiResponse.success(Map.of("needsUpdate", false)));
+                }
+            }
+        } else if (!allowAnonymousCheck && (userId == null || userId.isBlank())) {
+            // App explicitly requires login to check for updates even without gray targeting.
+            return ResponseEntity.ok(ApiResponse.success(Map.of("needsUpdate", false)));
         }
 
         String appStoreJumpUrl = hasText(v.getAppStoreUrl())