feat(ECR-022): CrisisCare CrisisPolicy 只读并 Closed

新增 crisis_policies、admin.crisis.read、列表/试匹配 API 与 admin-h5「危机」页；禁 CrisisEvent 写/UGC/真支付。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/service/admin/crisis.go

@@ -0,0 +1,39 @@
+package admin
+
+import (
+	"context"
+	"errors"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/repository"
+)
+
+var ErrCrisisPolicyNotFound = errString("crisis policy not found")
+
+// ListCrisisPolicies returns CrisisPolicy catalog.
+func (s *Service) ListCrisisPolicies(ctx context.Context) ([]repository.CrisisPolicyRow, error) {
+	items, err := s.Repo.ListCrisisPolicies(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if items == nil {
+		items = []repository.CrisisPolicyRow{}
+	}
+	return items, nil
+}
+
+// GetCrisisPolicy loads one policy.
+func (s *Service) GetCrisisPolicy(ctx context.Context, id uuid.UUID) (*repository.CrisisPolicyRow, error) {
+	row, err := s.Repo.GetCrisisPolicy(ctx, id)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, ErrCrisisPolicyNotFound
+	}
+	return row, err
+}
+
+// EvaluateCrisis runs read-only policy preview.
+func (s *Service) EvaluateCrisis(ctx context.Context, text string) ([]repository.CrisisMatch, error) {
+	return s.Repo.EvaluateCrisisPolicies(ctx, text)
+}

apps/api/internal/service/admin/rbac.go

@@ -28,6 +28,7 @@ const (
 	PermAskFeedbackWrite     = "admin.ask.feedback.write"
 	PermContentSafetyRead    = "admin.content_safety.read"
 	PermAIConfigRead         = "admin.ai_config.read"
+	PermCrisisRead           = "admin.crisis.read"
 )
 
 var knownPermissions = map[string]struct{}{
@@ -37,7 +38,7 @@ var knownPermissions = map[string]struct{}{
 	PermUsersStatusWrite: {}, PermMembershipPlansRead: {}, PermMembershipPlansWrite: {},
 	PermMembershipCodesRead: {}, PermMembershipCodesWrite: {},
 	PermAskRead: {}, PermAskFeedbackWrite: {}, PermContentSafetyRead: {},
-	PermAIConfigRead: {},
+	PermAIConfigRead: {}, PermCrisisRead: {},
 }
 
 var (