chore: 合入 stash Ops hardening 与 migration 000041

Ask/catalog 权限与审计加固、量表读权限统一，以及未提交的 ops hardening 变更。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/service/admin/quality_feedback.go

@@ -10,9 +10,10 @@ import (
 )
 
 var (
-	ErrBadFeedbackRating = errString("rating must be 1-5")
-	ErrBadFeedbackTag    = errString("invalid tag")
-	ErrFeedbackNoteLong  = errString("note too long")
+	ErrBadFeedbackRating   = errString("rating must be 1-5")
+	ErrBadFeedbackTag      = errString("invalid tag")
+	ErrFeedbackNoteLong    = errString("note too long")
+	ErrMessageNotInThread  = errString("message not in thread")
 )
 
 // ListQualityFeedback lists recent QualityFeedback.
@@ -54,6 +55,8 @@ func (s *Service) CreateQualityFeedback(
 		return nil, ErrFeedbackNoteLong
 	case strings.Contains(msg, "thread not found"):
 		return nil, ErrAskThreadNotFound
+	case strings.Contains(msg, "message not in thread"):
+		return nil, ErrMessageNotInThread
 	default:
 		return nil, err
 	}