feat(ECR-024): OpsCMS Banner 只读并 Closed

运营横幅目录（ops_banners + admin /cms），锁定 024–040 全队列。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/handler/admin.go

@@ -53,6 +53,7 @@ func (h *AdminHandler) Register(api *gin.RouterGroup) {
 	h.registerContentSafety(authed)
 	h.registerAIConfig(authed)
 	h.registerCrisis(authed)
+	h.registerCMS(authed)
 }
 
 func (h *AdminHandler) Login(c *gin.Context) {

apps/api/internal/handler/admin_cms.go

@@ -0,0 +1,46 @@
+package handler
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/middleware"
+	"github.com/yuxingu/digital-psychology/apps/api/internal/service/admin"
+	"github.com/yuxingu/digital-psychology/apps/api/pkg/response"
+)
+
+func (h *AdminHandler) registerCMS(authed *gin.RouterGroup) {
+	g := authed.Group("/cms")
+	g.GET("/banners", middleware.RequireAdminPermission(h.Svc, admin.PermCMSRead), h.ListBanners)
+	g.GET("/banners/:id", middleware.RequireAdminPermission(h.Svc, admin.PermCMSRead), h.GetBanner)
+}
+
+func (h *AdminHandler) ListBanners(c *gin.Context) {
+	items, err := h.Svc.ListBanners(c.Request.Context())
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50040, "list banners failed")
+		return
+	}
+	response.OK(c, gin.H{"items": items})
+}
+
+func (h *AdminHandler) GetBanner(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40002, "invalid id")
+		return
+	}
+	row, err := h.Svc.GetBanner(c.Request.Context(), id)
+	if errors.Is(err, admin.ErrBannerNotFound) {
+		response.Fail(c, http.StatusNotFound, 40410, "banner not found")
+		return
+	}
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50041, "get banner failed")
+		return
+	}
+	response.OK(c, row)
+}