0.10.1: 安全与业务逻辑加固、新品牌与部署加固

三轮审查修复(60+ 项),相对远端 main(b536672)的关键变更:
- 安全: 数据面 SSRF 拨号防护(防 DNS rebinding)/上游凭据剥离/登录防枚举
  与锁定态统一/可信代理(X-Forwarded-For)限流加固/会话版本失效机制/
  撤销即时传播/弱密钥拒绝启动/脱敏字节级重写(保签名契约)
- 业务逻辑: 裸 body 上传 panic/bootstrap 审计管线卡死/定价通配符优先级/
  全局工具可见性/调度器停机补跑/TOTP 挑战令牌消费顺序/熔断探针语义/
  >4MB 响应 token 计量/管理员重置密码作废会话 等
- 前端: 新 logo(语枢 AI 网关主题)/Provider 凭据异常警示/删除入口/
  后端错误消息透传/localStorage 敏感数据收敛
- 部署: CREDENTIAL_MASTER_KEY 持久化与弱值拒绝/Provider DELETE 接口/
  nginx 安全头/worker 内存限制
- 新增迁移 000029(key_hash 索引)/000030(usage_daily 币种维度)

internal/factcheck/engine.go

@@ -61,8 +61,9 @@ func NewEngine(pool *pgxpool.Pool, retriever EvidenceRetriever, logger *slog.Log
 // Check verifies one assistant answer against the configured knowledge bases
 // and persists a fact_check_events row. The returned Event has a zero ID when
 // fact-checking is not configured or no policy applies; callers should skip
-// quietly in that case.
-func (e *Engine) Check(ctx context.Context, requestID, question, answer string, verifier Verifier) (Event, error) {
+// quietly in that case. scope 形如 department:<uuid>(由调用方从资源部门推导);
+// 空 scope 时只应用 global 策略。
+func (e *Engine) Check(ctx context.Context, requestID, scope, question, answer string, verifier Verifier) (Event, error) {
 	if e == nil || e.retriever == nil || verifier == nil || strings.TrimSpace(answer) == "" {
 		return Event{}, nil
 	}
@@ -73,7 +74,7 @@ func (e *Engine) Check(ctx context.Context, requestID, question, answer string,
 	if strings.TrimSpace(settings.Model) == "" {
 		return Event{}, nil // not configured; skip without noise
 	}
-	policy, err := e.enabledPolicy(ctx)
+	policy, err := e.enabledPolicy(ctx, scope)
 	if err != nil {
 		return Event{}, err
 	}
@@ -117,8 +118,11 @@ func (e *Engine) checkSettings(ctx context.Context) (Settings, error) {
 	return x, err
 }
 
-func (e *Engine) enabledPolicy(ctx context.Context) (Policy, error) {
-	policy, err := scanPolicy(e.pool.QueryRow(ctx, policySelect+` WHERE enabled ORDER BY scope LIMIT 1`))
+// enabledPolicy 选择命中的策略:优先精确匹配调用方 scope(department:<uuid>
+// 等),否则回退 global。修复之前 ORDER BY scope LIMIT 1 只取字典序第一条
+// 的问题——多策略并存时其余部门的策略被静默忽略或张冠李戴。
+func (e *Engine) enabledPolicy(ctx context.Context, scope string) (Policy, error) {
+	policy, err := scanPolicy(e.pool.QueryRow(ctx, policySelect+` WHERE enabled AND (scope='global' OR scope=$1) ORDER BY (scope='global'),scope LIMIT 1`, scope))
 	if errors.Is(err, ErrNotFound) {
 		return Policy{}, nil
 	}