feat(ECR-024): OpsCMS Banner 只读并 Closed

运营横幅目录（ops_banners + admin /cms），锁定 024–040 全队列。

Co-authored-by: Cursor <cursoragent@cursor.com>

.ai/product/feature-spec/README.md

@@ -33,6 +33,7 @@
 | [ops-ai-core-config.md](ops-ai-core-config.md) | AI 核心配置 AICoreConfig | §7 | `admin-h5` `/ai` · `GET /admin/ai/system-prompts*` | Ops-D · **ECR-021 Closed** |
 | [ops-crisis-care.md](ops-crisis-care.md) | 危机关怀 CrisisCare | §7 | `admin-h5` `/crisis` · `GET /admin/crisis/policies*` | Ops-D · **ECR-022 Closed** |
 | [ops-knowledge-source.md](ops-knowledge-source.md) | AI 知识源 KnowledgeSource | §7 | `admin-h5` `/ai` · `GET /admin/ai/knowledge-sources*` | Ops-D · **ECR-023 Closed** |
+| [ops-banner.md](ops-banner.md) | OpsCMS Banner | §7 | `admin-h5` `/cms` · `GET /admin/cms/banners*` | Ops-D · **ECR-024 Closed** |
 
 新功能：复制 `_TEMPLATE.md` → 填满 → 在本表登记 → 再编码。
 

.ai/product/feature-spec/ops-banner.md

@@ -0,0 +1,41 @@
+# Feature Spec: OpsCMS · Banner（Ops · ECR-024）
+
+> Status: `Active`（Loop continuous · **ECR-024 Closed**）  
+> Parent: WAVE0-FROZEN · Predecessor: ECR-023 Closed  
+> Capability: `OpsCMS` · BC: `Ops_CMS_NoUGC`  
+> 授权：`docs/WAVE0/LOOP_AUTHORIZATION.md`
+
+## Non-goals
+
+Banner 写发布 · FeedSlot · ScheduledPublication · UGC · 真支付
+
+## L2 Domain
+
+| 概念 | 语义 |
+|------|------|
+| `Banner` | code 唯一；placement ∈ {home,explore,ask}；active/system；本切片只读 |
+
+## L3 API
+
+| Method | Path | 权限 | 语义 |
+|--------|------|------|------|
+| GET | `/admin/cms/banners` | `admin.cms.read` | 只读 |
+| GET | `/admin/cms/banners/{id}` | `admin.cms.read` | 只读 |
+
+## Migration
+
+`000025`：表 + 种子（若有） + 授予 admin.cms.read
+
+## L4 AC
+
+| ID | Then |
+|----|------|
+| AC-F-01 | list 含种子或空列表合法 |
+| AC-F-02 | 已知 id get 200 |
+| AC-F-03 | 未知 id → 404 |
+| AC-S-01 | 无 Admin → 401 |
+| AC-S-02 | 无权限 → 403 |
+| AC-P-01 | list < 500ms |
+| AC-O-01 | N/A 只读 |
+
+contract_diff: `docs/CONTRACT_DIFF/ECR-024.yaml`