feat(ECR-021): AICoreConfig SystemPrompt 只读并 Closed

新增 system_prompts 目录、admin.ai_config.read 与 admin-h5「AI」页；本切片不改运行时 Prompt、禁写发布/UGC/真支付。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/service/admin/ai_config.go

@@ -0,0 +1,34 @@
+package admin
+
+import (
+	"context"
+	"errors"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/repository"
+)
+
+var ErrSystemPromptNotFound = errString("system prompt not found")
+
+// ListSystemPrompts returns SystemPrompt catalog.
+func (s *Service) ListSystemPrompts(ctx context.Context) ([]repository.SystemPromptRow, error) {
+	items, err := s.Repo.ListSystemPrompts(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if items == nil {
+		items = []repository.SystemPromptRow{}
+	}
+	return items, nil
+}
+
+// GetSystemPrompt loads one prompt.
+func (s *Service) GetSystemPrompt(ctx context.Context, id uuid.UUID) (*repository.SystemPromptRow, error) {
+	row, err := s.Repo.GetSystemPrompt(ctx, id)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, ErrSystemPromptNotFound
+	}
+	return row, err
+}

apps/api/internal/service/admin/rbac.go

@@ -27,6 +27,7 @@ const (
 	PermAskRead              = "admin.ask.read"
 	PermAskFeedbackWrite     = "admin.ask.feedback.write"
 	PermContentSafetyRead    = "admin.content_safety.read"
+	PermAIConfigRead         = "admin.ai_config.read"
 )
 
 var knownPermissions = map[string]struct{}{
@@ -36,6 +37,7 @@ var knownPermissions = map[string]struct{}{
 	PermUsersStatusWrite: {}, PermMembershipPlansRead: {}, PermMembershipPlansWrite: {},
 	PermMembershipCodesRead: {}, PermMembershipCodesWrite: {},
 	PermAskRead: {}, PermAskFeedbackWrite: {}, PermContentSafetyRead: {},
+	PermAIConfigRead: {},
 }
 
 var (