chore: 合入 stash Ops hardening 与 migration 000041

Ask/catalog 权限与审计加固、量表读权限统一，以及未提交的 ops hardening 变更。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/middleware/admin_permission.go

@@ -18,6 +18,11 @@ type AdminPermissionChecker interface {
 
 // RequireAdminPermission aborts with 403 when the admin lacks code.
 func RequireAdminPermission(checker AdminPermissionChecker, code string) gin.HandlerFunc {
+	return RequireAnyAdminPermission(checker, code)
+}
+
+// RequireAnyAdminPermission aborts with 403 when the admin lacks all of codes.
+func RequireAnyAdminPermission(checker AdminPermissionChecker, codes ...string) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		adminID, ok := AdminIDFromContext(c)
 		if !ok {
@@ -25,18 +30,27 @@ func RequireAdminPermission(checker AdminPermissionChecker, code string) gin.Han
 			c.Abort()
 			return
 		}
-		okPerm, err := checker.HasPermission(c.Request.Context(), adminID, code)
-		if err != nil {
+		if len(codes) == 0 {
 			response.Fail(c, http.StatusInternalServerError, 50000, "permission check failed")
 			c.Abort()
 			return
 		}
-		if !okPerm {
-			checker.DenyPermission(c.Request.Context(), adminID, code, c.FullPath())
-			response.Fail(c, http.StatusForbidden, 40301, "forbidden")
-			c.Abort()
-			return
+		var lastCode string
+		for _, code := range codes {
+			lastCode = code
+			okPerm, err := checker.HasPermission(c.Request.Context(), adminID, code)
+			if err != nil {
+				response.Fail(c, http.StatusInternalServerError, 50000, "permission check failed")
+				c.Abort()
+				return
+			}
+			if okPerm {
+				c.Next()
+				return
+			}
 		}
-		c.Next()
+		checker.DenyPermission(c.Request.Context(), adminID, lastCode, c.FullPath())
+		response.Fail(c, http.StatusForbidden, 40301, "forbidden")
+		c.Abort()
 	}
 }