feat(ECR-043): StarConfig 写面闭环并 Closed

加法权限 admin.explore.write、POST/PUT+审计、C端 GET /star/configs、
H5 无 active 空态/失败回退；migration 000052。ExploreConfig Loop STOP，禁自动 ECR-044。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/handler/admin_star_config.go

@@ -16,6 +16,8 @@ func (h *AdminHandler) registerStarConfigs(authed *gin.RouterGroup) {
 	g := authed.Group("/explore")
 	g.GET("/star-configs", middleware.RequireAdminPermission(h.Svc, admin.PermExploreRead), h.ListStarConfigs)
 	g.GET("/star-configs/:id", middleware.RequireAdminPermission(h.Svc, admin.PermExploreRead), h.GetStarConfig)
+	g.POST("/star-configs", middleware.RequireAdminPermission(h.Svc, admin.PermExploreWrite), h.CreateStarConfig)
+	g.PUT("/star-configs/:id", middleware.RequireAdminPermission(h.Svc, admin.PermExploreWrite), h.UpdateStarConfig)
 }
 
 func (h *AdminHandler) ListStarConfigs(c *gin.Context) {
@@ -44,3 +46,66 @@ func (h *AdminHandler) GetStarConfig(c *gin.Context) {
 	}
 	response.OK(c, row)
 }
+
+func (h *AdminHandler) CreateStarConfig(c *gin.Context) {
+	adminID, ok := middleware.AdminIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40101, "admin auth required")
+		return
+	}
+	var body admin.StarConfigWriteBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.Fail(c, http.StatusBadRequest, 40054, "invalid body")
+		return
+	}
+	row, err := h.Svc.CreateStarConfig(c.Request.Context(), adminID, body)
+	if errors.Is(err, admin.ErrInvalidStarConfig) {
+		response.Fail(c, http.StatusBadRequest, 40055, "invalid star config")
+		return
+	}
+	if errors.Is(err, admin.ErrStarConfigConflict) {
+		response.Fail(c, http.StatusConflict, 40912, "star config code conflict")
+		return
+	}
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50052, "create star config failed")
+		return
+	}
+	response.OK(c, row)
+}
+
+func (h *AdminHandler) UpdateStarConfig(c *gin.Context) {
+	adminID, ok := middleware.AdminIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40101, "admin auth required")
+		return
+	}
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40002, "invalid id")
+		return
+	}
+	var body admin.StarConfigWriteBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.Fail(c, http.StatusBadRequest, 40054, "invalid body")
+		return
+	}
+	row, err := h.Svc.UpdateStarConfig(c.Request.Context(), adminID, id, body)
+	if errors.Is(err, admin.ErrStarConfigNotFound) {
+		response.Fail(c, http.StatusNotFound, 40420, "star-config not found")
+		return
+	}
+	if errors.Is(err, admin.ErrInvalidStarConfig) {
+		response.Fail(c, http.StatusBadRequest, 40055, "invalid star config")
+		return
+	}
+	if errors.Is(err, admin.ErrStarConfigConflict) {
+		response.Fail(c, http.StatusConflict, 40912, "star config code conflict")
+		return
+	}
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50053, "update star config failed")
+		return
+	}
+	response.OK(c, row)
+}

apps/api/internal/handler/star_config_public.go

@@ -0,0 +1,36 @@
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/repository"
+	"github.com/yuxingu/digital-psychology/apps/api/pkg/response"
+)
+
+// StarConfigPublicHandler serves GET /api/v1/star/configs (DeviceAuth).
+type StarConfigPublicHandler struct {
+	Repo *repository.AdminRepo
+}
+
+// Register mounts public star config routes.
+func (h *StarConfigPublicHandler) Register(api *gin.RouterGroup) {
+	api.GET("/star/configs", h.ListActive)
+}
+
+func (h *StarConfigPublicHandler) ListActive(c *gin.Context) {
+	if h.Repo == nil {
+		response.OK(c, gin.H{"items": []repository.StarConfigRow{}})
+		return
+	}
+	items, err := h.Repo.ListActiveStarConfigs(c.Request.Context())
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50054, "star configs failed")
+		return
+	}
+	if items == nil {
+		items = []repository.StarConfigRow{}
+	}
+	response.OK(c, gin.H{"items": items})
+}