feat(ECR-041): OpsCMS Banner 薄写面（Write-Wave 首刀）

Admin POST/PUT + admin.cms.write/审计；C 端 GET /home/banners；首页投影回退静态 homeFeeds；migration 000051；不碰 FeedSlot/支付/UGC。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/migrations/000051_ops_banner_write.down.sql

@@ -0,0 +1,5 @@
+-- ECR-041 rollback: revoke cms.write from super_admin
+
+DELETE FROM admin_role_permissions
+WHERE code = 'admin.cms.write'
+  AND role_id IN (SELECT id FROM admin_roles WHERE name = 'super_admin');

apps/api/migrations/000051_ops_banner_write.up.sql

@@ -0,0 +1,7 @@
+-- ECR-041 OpsCMS Banner write (additive permission)
+
+INSERT INTO admin_role_permissions(role_id, code)
+SELECT r.id, 'admin.cms.write'
+FROM admin_roles r
+WHERE r.name = 'super_admin'
+ON CONFLICT DO NOTHING;