feat(ECR-019): ContentSafety FilterRule 只读并 Closed

新增 filter_rules、admin.content_safety.read、列表/详情/试匹配 API 与 admin-h5「安全」页；禁审核写/UGC/真支付。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/migrations/000020_content_safety_filter.down.sql

@@ -0,0 +1,4 @@
+-- ECR-019 down
+
+DELETE FROM admin_role_permissions WHERE code = 'admin.content_safety.read';
+DROP TABLE IF EXISTS filter_rules;

apps/api/migrations/000020_content_safety_filter.up.sql

@@ -0,0 +1,33 @@
+-- ECR-019 ContentSafety FilterRule
+
+CREATE TABLE IF NOT EXISTS filter_rules (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  code varchar(64) NOT NULL UNIQUE,
+  title varchar(128) NOT NULL,
+  category varchar(32) NOT NULL
+    CHECK (category IN ('crisis','abuse','spam','pii')),
+  pattern text NOT NULL,
+  action varchar(32) NOT NULL
+    CHECK (action IN ('flag','block','escalate')),
+  active boolean NOT NULL DEFAULT true,
+  system boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_filter_rules_category ON filter_rules(category);
+CREATE INDEX IF NOT EXISTS idx_filter_rules_active ON filter_rules(active);
+
+INSERT INTO filter_rules(code, title, category, pattern, action, active, system)
+VALUES
+  ('crisis_self_harm', '自伤危机关键词', 'crisis', '不想活了', 'escalate', true, true),
+  ('abuse_threat', '人身威胁', 'abuse', '弄死你', 'block', true, true),
+  ('spam_promo', '营销骚扰', 'spam', '加微信领红包', 'flag', true, true),
+  ('pii_id_card', '身份证号形态提示', 'pii', '身份证号', 'flag', true, true)
+ON CONFLICT (code) DO NOTHING;
+
+INSERT INTO admin_role_permissions(role_id, code)
+SELECT r.id, 'admin.content_safety.read'
+FROM admin_roles r
+WHERE r.name = 'super_admin'
+ON CONFLICT DO NOTHING;