feat(ECR-017): AskOperations 问答会话只读并 Closed

新增 admin.ask.read、GET /admin/ask/threads*（AskSessionView）与 admin-h5「问答」页；禁改消息/UGC/真支付。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/service/admin/ask_ops.go

@@ -0,0 +1,50 @@
+package admin
+
+import (
+	"context"
+	"errors"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/repository"
+)
+
+// AskSessionDetail is AskSessionView plus messages.
+type AskSessionDetail struct {
+	repository.AskSessionView
+	Messages []repository.AskMessageView `json:"messages"`
+}
+
+var ErrAskThreadNotFound = errString("ask thread not found")
+
+// ListAskSessions lists AskSessionView rows.
+func (s *Service) ListAskSessions(ctx context.Context, userID *uuid.UUID, limit, offset int) ([]repository.AskSessionView, error) {
+	items, err := s.Repo.ListAskSessions(ctx, userID, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	if items == nil {
+		items = []repository.AskSessionView{}
+	}
+	return items, nil
+}
+
+// GetAskSessionDetail loads meta + messages.
+func (s *Service) GetAskSessionDetail(ctx context.Context, threadID uuid.UUID) (*AskSessionDetail, error) {
+	view, err := s.Repo.GetAskSession(ctx, threadID)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, ErrAskThreadNotFound
+	}
+	if err != nil {
+		return nil, err
+	}
+	msgs, err := s.Repo.ListAskMessagesForAdmin(ctx, threadID)
+	if err != nil {
+		return nil, err
+	}
+	if msgs == nil {
+		msgs = []repository.AskMessageView{}
+	}
+	return &AskSessionDetail{AskSessionView: *view, Messages: msgs}, nil
+}

apps/api/internal/service/admin/rbac.go

@@ -24,6 +24,7 @@ const (
 	PermMembershipPlansWrite = "admin.membership.plans.write"
 	PermMembershipCodesRead  = "admin.membership.codes.read"
 	PermMembershipCodesWrite = "admin.membership.codes.write"
+	PermAskRead              = "admin.ask.read"
 )
 
 var knownPermissions = map[string]struct{}{
@@ -32,6 +33,7 @@ var knownPermissions = map[string]struct{}{
 	PermContentWrite: {}, PermRolesRead: {}, PermRolesWrite: {},
 	PermUsersStatusWrite: {}, PermMembershipPlansRead: {}, PermMembershipPlansWrite: {},
 	PermMembershipCodesRead: {}, PermMembershipCodesWrite: {},
+	PermAskRead: {},
 }
 
 var (