feat(ECR-043): StarConfig 写面闭环并 Closed

加法权限 admin.explore.write、POST/PUT+审计、C端 GET /star/configs、
H5 无 active 空态/失败回退；migration 000052。ExploreConfig Loop STOP，禁自动 ECR-044。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/handler/admin_star_config.go

@@ -16,6 +16,8 @@ func (h *AdminHandler) registerStarConfigs(authed *gin.RouterGroup) {
 	g := authed.Group("/explore")
 	g.GET("/star-configs", middleware.RequireAdminPermission(h.Svc, admin.PermExploreRead), h.ListStarConfigs)
 	g.GET("/star-configs/:id", middleware.RequireAdminPermission(h.Svc, admin.PermExploreRead), h.GetStarConfig)
+	g.POST("/star-configs", middleware.RequireAdminPermission(h.Svc, admin.PermExploreWrite), h.CreateStarConfig)
+	g.PUT("/star-configs/:id", middleware.RequireAdminPermission(h.Svc, admin.PermExploreWrite), h.UpdateStarConfig)
 }
 
 func (h *AdminHandler) ListStarConfigs(c *gin.Context) {
@@ -44,3 +46,66 @@ func (h *AdminHandler) GetStarConfig(c *gin.Context) {
 	}
 	response.OK(c, row)
 }
+
+func (h *AdminHandler) CreateStarConfig(c *gin.Context) {
+	adminID, ok := middleware.AdminIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40101, "admin auth required")
+		return
+	}
+	var body admin.StarConfigWriteBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.Fail(c, http.StatusBadRequest, 40054, "invalid body")
+		return
+	}
+	row, err := h.Svc.CreateStarConfig(c.Request.Context(), adminID, body)
+	if errors.Is(err, admin.ErrInvalidStarConfig) {
+		response.Fail(c, http.StatusBadRequest, 40055, "invalid star config")
+		return
+	}
+	if errors.Is(err, admin.ErrStarConfigConflict) {
+		response.Fail(c, http.StatusConflict, 40912, "star config code conflict")
+		return
+	}
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50052, "create star config failed")
+		return
+	}
+	response.OK(c, row)
+}
+
+func (h *AdminHandler) UpdateStarConfig(c *gin.Context) {
+	adminID, ok := middleware.AdminIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40101, "admin auth required")
+		return
+	}
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40002, "invalid id")
+		return
+	}
+	var body admin.StarConfigWriteBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.Fail(c, http.StatusBadRequest, 40054, "invalid body")
+		return
+	}
+	row, err := h.Svc.UpdateStarConfig(c.Request.Context(), adminID, id, body)
+	if errors.Is(err, admin.ErrStarConfigNotFound) {
+		response.Fail(c, http.StatusNotFound, 40420, "star-config not found")
+		return
+	}
+	if errors.Is(err, admin.ErrInvalidStarConfig) {
+		response.Fail(c, http.StatusBadRequest, 40055, "invalid star config")
+		return
+	}
+	if errors.Is(err, admin.ErrStarConfigConflict) {
+		response.Fail(c, http.StatusConflict, 40912, "star config code conflict")
+		return
+	}
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50053, "update star config failed")
+		return
+	}
+	response.OK(c, row)
+}