chore: 合入 stash Ops hardening 与 migration 000041

Ask/catalog 权限与审计加固、量表读权限统一，以及未提交的 ops hardening 变更。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/integration/quality_feedback_test.go

@@ -132,5 +132,34 @@ func TestQualityFeedback(t *testing.T) {
 	if !okAudit {
 		t.Fatal("missing ask.feedback.create audit")
 	}
+
+	// cross-thread message_id must be rejected
+	env, key = doJSON(t, r, http.MethodPost, "/api/v1/ask/threads", map[string]any{
+		"profile_id": profileID, "scene": "self",
+	}, key)
+	otherThread := decodeData[map[string]any](t, env.Data)["id"].(string)
+	env, key = doJSON(t, r, http.MethodPost, "/api/v1/ask/threads/"+otherThread+"/messages", map[string]any{
+		"content": "另一线程",
+	}, key)
+	// fetch a message id from other thread via admin transcript
+	env, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads/"+otherThread+"/messages", nil, tok)
+	if code != 200 {
+		t.Fatalf("other transcript http=%d", code)
+	}
+	var otherDetail struct {
+		Messages []struct {
+			ID string `json:"id"`
+		} `json:"messages"`
+	}
+	_ = json.Unmarshal(env.Data, &otherDetail)
+	if len(otherDetail.Messages) == 0 {
+		t.Fatal("expected messages on other thread")
+	}
+	foreignMsg := otherDetail.Messages[0].ID
+	_, code = doAdminJSON(t, r, http.MethodPost, "/api/v1/admin/ask/threads/"+threadID+"/feedback",
+		map[string]any{"rating": 2, "tag": "other", "message_id": foreignMsg}, tok)
+	if code != http.StatusBadRequest {
+		t.Fatalf("expected 400 for foreign message_id, got %d", code)
+	}
 	_ = key
 }