chore: 合入 stash Ops hardening 与 migration 000041

Ask/catalog 权限与审计加固、量表读权限统一，以及未提交的 ops hardening 变更。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/repository/cms_repo.go

@@ -28,7 +28,7 @@ func (r *AdminRepo) ListBanners(ctx context.Context) ([]BannerRow, error) {
 	rows, err := r.Pool.Query(ctx, `
 		SELECT id, code, title, placement, image_url, link_path, sort_order, active, system, updated_at
 		FROM ops_banners
-		ORDER BY active DESC, sort_order ASC, code ASC`)
+		ORDER BY active DESC, sort_order ASC, code ASC LIMIT 500`)
 	if err != nil {
 		return nil, err
 	}
@@ -83,7 +83,7 @@ func (r *AdminRepo) ListFeedSlots(ctx context.Context) ([]FeedSlotRow, error) {
 	rows, err := r.Pool.Query(ctx, `
 		SELECT id, code, title, slot_key, placement, active, system, updated_at
 		FROM ops_feed_slots
-		ORDER BY active DESC, code ASC`)
+		ORDER BY active DESC, code ASC LIMIT 500`)
 	if err != nil {
 		return nil, err
 	}