chore: 合入 stash Ops hardening 与 migration 000041

Ask/catalog 权限与审计加固、量表读权限统一，以及未提交的 ops hardening 变更。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/repository/quality_feedback_repo.go

@@ -76,6 +76,15 @@ func (r *AdminRepo) CreateAdminQualityFeedback(
 	if !ok {
 		return nil, errors.New("ask thread not found")
 	}
+	if messageID != nil {
+		inThread, err := r.askMessageInThread(ctx, threadID, *messageID)
+		if err != nil {
+			return nil, err
+		}
+		if !inThread {
+			return nil, errors.New("message not in thread")
+		}
+	}
 	tx, err := r.Pool.Begin(ctx)
 	if err != nil {
 		return nil, err
@@ -117,6 +126,18 @@ func (r *AskRepo) CreateUserQualityFeedback(
 	if err != nil {
 		return nil, errors.New("ask thread not found")
 	}
+	if messageID != nil {
+		var n int
+		err = r.Pool.QueryRow(ctx, `
+			SELECT 1 FROM ask_messages
+			WHERE id=$1 AND thread_id=$2 AND deleted_at IS NULL`, *messageID, threadID).Scan(&n)
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, errors.New("message not in thread")
+		}
+		if err != nil {
+			return nil, err
+		}
+	}
 	var f QualityFeedbackRow
 	err = r.Pool.QueryRow(ctx, `
 		INSERT INTO ask_quality_feedback(thread_id, message_id, source, rating, tag, note, created_by_user)
@@ -138,6 +159,17 @@ func (r *AdminRepo) askThreadExists(ctx context.Context, threadID uuid.UUID) (bo
 	return err == nil, err
 }
 
+func (r *AdminRepo) askMessageInThread(ctx context.Context, threadID, messageID uuid.UUID) (bool, error) {
+	var n int
+	err := r.Pool.QueryRow(ctx, `
+		SELECT 1 FROM ask_messages
+		WHERE id=$1 AND thread_id=$2 AND deleted_at IS NULL`, messageID, threadID).Scan(&n)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return false, nil
+	}
+	return err == nil, err
+}
+
 func validateFeedback(rating int, tag, note *string) error {
 	if rating < 1 || rating > 5 {
 		return errors.New("rating must be 1-5")