feat(ECR-024): OpsCMS Banner 只读并 Closed

运营横幅目录（ops_banners + admin /cms），锁定 024–040 全队列。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/migrations/000025_ops_banners.down.sql

@@ -0,0 +1,3 @@
+-- ECR-024 down
+DELETE FROM admin_role_permissions WHERE code = 'admin.cms.read';
+DROP TABLE IF EXISTS ops_banners;

apps/api/migrations/000025_ops_banners.up.sql

@@ -0,0 +1,37 @@
+-- ECR-024 OpsCMS Banner (read catalog)
+
+CREATE TABLE IF NOT EXISTS ops_banners (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  code varchar(64) NOT NULL UNIQUE,
+  title varchar(128) NOT NULL,
+  placement varchar(32) NOT NULL
+    CHECK (placement IN ('home','explore','ask')),
+  image_url text NULL,
+  link_path varchar(256) NULL,
+  sort_order int NOT NULL DEFAULT 0,
+  active boolean NOT NULL DEFAULT true,
+  system boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_ops_banners_active ON ops_banners(active);
+
+INSERT INTO ops_banners(code, title, placement, image_url, link_path, sort_order, active, system)
+VALUES (
+  'home_promo',
+  '首页运营横幅占位',
+  'home',
+  NULL,
+  '/membership',
+  10,
+  true,
+  true
+)
+ON CONFLICT (code) DO NOTHING;
+
+INSERT INTO admin_role_permissions(role_id, code)
+SELECT r.id, 'admin.cms.read'
+FROM admin_roles r
+WHERE r.name = 'super_admin'
+ON CONFLICT DO NOTHING;