feat(ECR-043): StarConfig 写面闭环并 Closed

加法权限 admin.explore.write、POST/PUT+审计、C端 GET /star/configs、
H5 无 active 空态/失败回退；migration 000052。ExploreConfig Loop STOP，禁自动 ECR-044。

Co-authored-by: Cursor <cursoragent@cursor.com>

proto/openapi.yaml

@@ -1182,6 +1182,21 @@ paths:
           description: Unauthorized
         '403':
           description: Forbidden
+    post:
+      tags: [admin]
+      summary: Create StarConfig
+      description: Requires admin.explore.write · ECR-043
+      responses:
+        '200':
+          description: OK
+        '400':
+          description: Invalid
+        '401':
+          description: Unauthorized
+        '403':
+          description: Forbidden
+        '409':
+          description: Code conflict
 
   /api/v1/admin/explore/star-configs/{id}:
     get:
@@ -1197,6 +1212,26 @@ paths:
           description: OK
         '404':
           description: Not found
+    put:
+      tags: [admin]
+      summary: Update StarConfig
+      description: Requires admin.explore.write · deactivate via active=false · ECR-043
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { type: string, format: uuid }
+      responses:
+        '200':
+          description: OK
+        '400':
+          description: Invalid
+        '403':
+          description: Forbidden
+        '404':
+          description: Not found
+        '409':
+          description: Code conflict
 
   /api/v1/admin/explore/rhythm-configs:
     get:
@@ -1540,6 +1575,15 @@ paths:
         '200':
           description: OK
 
+  /api/v1/star/configs:
+    get:
+      tags: [system]
+      summary: Active StarConfig list for C-end (ECR-043)
+      description: DeviceAuth · only active=true · ordered by code
+      responses:
+        '200':
+          description: OK
+
   /api/v1/home/daily-tips:
     get:
       tags: [system]