chore: 合入 stash Ops hardening 与 migration 000041

Ask/catalog 权限与审计加固、量表读权限统一，以及未提交的 ops hardening 变更。

Co-authored-by: Cursor <cursoragent@cursor.com>

proto/openapi.yaml

@@ -566,8 +566,8 @@ paths:
   /api/v1/admin/ask/threads/{id}:
     get:
       tags: [admin]
-      summary: Ask session detail with messages
-      description: Requires admin.ask.read; no message mutation
+      summary: Ask session meta (no message bodies)
+      description: Requires admin.ask.read; transcript via /messages
       parameters:
         - in: path
           name: id
@@ -579,6 +579,26 @@ paths:
         '404':
           description: Not found
 
+  /api/v1/admin/ask/threads/{id}/messages:
+    get:
+      tags: [admin]
+      summary: Ask session transcript (audited)
+      description: Requires admin.ask.transcript.read; writes ask.transcript.read audit
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { type: string, format: uuid }
+      responses:
+        '200':
+          description: OK
+        '401':
+          description: Unauthorized
+        '403':
+          description: Forbidden
+        '404':
+          description: Not found
+
   /api/v1/admin/content-safety/filter-rules:
     get:
       tags: [admin]
@@ -918,7 +938,7 @@ paths:
     get:
       tags: [admin]
       summary: List ModerationCase catalog
-      description: Requires admin.content_safety.read
+      description: Requires admin.content_safety.read; TYPE CATALOG only — not live moderation tickets
       responses:
         '200':
           description: OK
@@ -946,7 +966,7 @@ paths:
     get:
       tags: [admin]
       summary: List CrisisEvent catalog
-      description: Requires admin.crisis.read
+      description: Requires admin.crisis.read; TYPE CATALOG only — not user crisis cases
       responses:
         '200':
           description: OK
@@ -1198,7 +1218,7 @@ paths:
     get:
       tags: [admin]
       summary: List FunnelDefinition catalog
-      description: Requires admin.analytics.read
+      description: Requires admin.growth.read; catalog only
       responses:
         '200':
           description: OK