feat(ECR-023): AICoreConfig KnowledgeSource 只读并 Closed

运营可观测知识源目录（knowledge_sources + admin /ai），不含 Chunk/Embedding。

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/CONTRACT_DIFF/ECR-023.yaml

@@ -0,0 +1,23 @@
+ecr: ECR-023
+capability: AICoreConfig
+bounded_context: Ask_Ops
+parent: WAVE0-FROZEN
+predecessor: ECR-022
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds knowledge_sources catalog with system seed ask_grounding and read admin APIs.
+  Reuses admin.ai_config.read. Does not introduce KnowledgeChunk or embeddings.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/ai/knowledge-sources
+    change: added
+  - method: GET
+    path: /api/v1/admin/ai/knowledge-sources/{id}
+    change: added
+perms:
+  - code: admin.ai_config.read
+    change: unchanged