chore: 合入 stash Ops hardening 与 migration 000041

Ask/catalog 权限与审计加固、量表读权限统一，以及未提交的 ops hardening 变更。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/migrations/000041_ops_hardening.down.sql

@@ -0,0 +1,7 @@
+DELETE FROM admin_role_permissions WHERE code = 'admin.ask.transcript.read';
+
+COMMENT ON TABLE crisis_events IS NULL;
+COMMENT ON TABLE intervention_outcomes IS NULL;
+COMMENT ON TABLE privacy_requests IS NULL;
+COMMENT ON TABLE ask_handoff_cases IS NULL;
+COMMENT ON TABLE moderation_cases IS NULL;

apps/api/migrations/000041_ops_hardening.up.sql

@@ -0,0 +1,13 @@
+-- Ops hardening: Ask transcript perm + catalog≠case comments (review follow-up)
+
+INSERT INTO admin_role_permissions(role_id, code)
+SELECT r.id, 'admin.ask.transcript.read'
+FROM admin_roles r
+WHERE r.name = 'super_admin'
+ON CONFLICT DO NOTHING;
+
+COMMENT ON TABLE crisis_events IS 'CATALOG ONLY: crisis event type placeholders. Not user crisis cases.';
+COMMENT ON TABLE intervention_outcomes IS 'CATALOG ONLY: intervention outcome type placeholders. Not user case outcomes.';
+COMMENT ON TABLE privacy_requests IS 'CATALOG ONLY: privacy request type placeholders. Not user privacy tickets.';
+COMMENT ON TABLE ask_handoff_cases IS 'CATALOG ONLY: handoff case type placeholders. Not live handoff tickets.';
+COMMENT ON TABLE moderation_cases IS 'CATALOG ONLY: moderation case type placeholders. Not live moderation tickets.';