refactor(access): 统一分层白名单权限语义

取消跨主体专属占用，按租户、用户组、用户、当前 API Key 和 scope 分层求交，并在任务落库前统一校验候选。\n\n增加旧 allow 规则归档清理迁移、脱敏审计工具和回滚运行手册，补齐主体隔离、deny 优先及列表与运行时一致性测试。

scripts/migration-safety-reviewed.json

@@ -37,6 +37,14 @@
         "non-null column addition"
       ],
       "reason": "The adaptive Worker columns use constant defaults on gateway_worker_instances, so PostgreSQL 18 can add them without rewriting the table. Production preflight on 2026-08-03 found 96 rows and a 180224-byte relation; the explicit backfill and constraint validation are therefore bounded. The only change to the 31899648-byte gateway_concurrency_leases relation is a nullable numeric column and a NOT VALID check followed by validation."
+    },
+    "apps/api/migrations/0102_access_rule_allow_whitelist_semantics.sql": {
+      "sha256": "7f65855237b7e5ae38b6d80228bf446e5c28eb22956272ced15c9f492b9aad40",
+      "allowedViolations": [
+        "procedural SQL body",
+        "DELETE FROM operation"
+      ],
+      "reason": "This one-time semantic migration takes a write-blocking/read-compatible lock, records count and SHA-256 manifests, archives every legacy allow row, verifies the archive, and only then deletes legacy allows. Deny rows are checksummed before cleanup and verified unchanged afterward. The procedural blocks make any count or checksum mismatch abort the transaction; reapplying after new whitelist writes also fails before deleting them."
     }
   }
 }