```

feat: 添加数据库迁移脚本并更新Dockerfile配置

- 在Dockerfile中添加alembic配置文件和目录的复制指令
- 更新alembic/env.py注册新的模块模型：events、workflows、writebacks
- 生成完整的初始数据库schema迁移脚本，包含以下表：
  - approval_requests, attendance_records, audit_logs, domain_events
  - expenses, feishu_event_receipts, fund_accounts, legacy_sync_runs
  - official_writeback_runs, performance_metrics, policies, procurements
  - projects, report_push_runs, risk_event_actions, risk_events
  - standards, suppliers, work_reports, work_tasks, workflow_actions
  - workflow_instances等21个数据表结构定义
- 在API路由器中添加新模块的路由：events、workflows、writebacks、observability
```

app/modules/risk/service.py

@@ -2,6 +2,7 @@ from datetime import date
 from decimal import Decimal
 from typing import Any
 
+from fastapi import HTTPException, status
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
@@ -16,12 +17,15 @@ from app.modules.audit.constants import (
 )
 from app.modules.audit.schemas import AuditLogCreate
 from app.modules.audit.service import AuditService
+from app.modules.approvals.constants import ApprovalActionValue, approval_action
+from app.modules.approvals.service import ApprovalService
 from app.modules.business.constants import (
     CLOSED_RISK_STATUSES,
     DONE_STATUSES,
     GENERATED_RISK_EVENT_TYPES,
     PROJECT_CLOSED_STATUSES,
     SUPPLIER_RISK_LEVELS,
+    BusinessErrorDetail,
     BusinessDomain,
     RiskEventType,
     RiskLevel,
@@ -36,10 +40,18 @@ from app.modules.business.models import (
     WorkTask,
 )
 from app.modules.business.service import serialize_model
+from app.modules.events.constants import (
+    EventAggregateType,
+    EventPayloadKey,
+    EventSource,
+    EventType,
+)
+from app.modules.events.service import EventService
 from app.modules.risk.constants import (
     RISK_SCORE_WEIGHTS,
     RiskEventActionKey,
     RiskEventActionValue,
+    RiskErrorDetail,
     RiskGenerationAction,
     RiskGenerationResultKey,
     RiskEventPayloadKey,
@@ -131,7 +143,7 @@ class RiskService:
             from_status,
             record.status,
             comment,
-            {"assigned_to": assigned_to},
+            {RiskEventActionKey.ASSIGNED_TO: assigned_to},
         )
         self.db.commit()
         self.db.refresh(record)
@@ -191,8 +203,20 @@ class RiskService:
         closed_reason: str,
         review_summary: str | None = None,
         actor: str = ActorValue.API,
+        approval_ticket_id: str | None = None,
     ) -> dict[str, Any]:
         record = self._get_event(risk_event_id)
+        approval_payload = {
+            RiskEventPayloadKey.STATUS: StatusValue.CLOSED,
+            "closed_reason": closed_reason,
+            RiskEventActionKey.REVIEW_SUMMARY: review_summary,
+        }
+        self._consume_risk_approval(
+            approval_ticket_id,
+            risk_event_id,
+            approval_payload,
+            actor,
+        )
         from_status = record.status
         now = utc_now()
         record.status = StatusValue.CLOSED
@@ -208,7 +232,7 @@ class RiskService:
             from_status,
             record.status,
             closed_reason,
-            {"review_summary": review_summary},
+            {RiskEventActionKey.REVIEW_SUMMARY: review_summary},
         )
         self.db.commit()
         self.db.refresh(record)
@@ -220,8 +244,19 @@ class RiskService:
         risk_event_id: int,
         comment: str | None = None,
         actor: str = ActorValue.API,
+        approval_ticket_id: str | None = None,
     ) -> dict[str, Any]:
         record = self._get_event(risk_event_id)
+        approval_payload = {
+            RiskEventPayloadKey.STATUS: StatusValue.OPEN,
+            RiskEventActionKey.COMMENT: comment,
+        }
+        self._consume_risk_approval(
+            approval_ticket_id,
+            risk_event_id,
+            approval_payload,
+            actor,
+        )
         from_status = record.status
         record.status = StatusValue.OPEN
         record.resolved_at = None
@@ -277,7 +312,10 @@ class RiskService:
         if record is None:
             from fastapi import HTTPException, status
 
-            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Risk event not found")
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail=RiskErrorDetail.RISK_EVENT_NOT_FOUND,
+            )
         return record
 
     def _record_action(
@@ -312,13 +350,31 @@ class RiskService:
                 risk_level=AuditRiskLevel.MEDIUM,
                 request_payload={
                     RiskEventActionKey.ACTION: action,
-                    "from_status": from_status,
-                    "to_status": to_status,
-                    "comment": comment,
-                    "payload": payload,
+                    RiskEventActionKey.FROM_STATUS: from_status,
+                    RiskEventActionKey.TO_STATUS: to_status,
+                    RiskEventActionKey.COMMENT: comment,
+                    RiskEventActionKey.PAYLOAD: payload,
                 },
             )
         )
+        EventService(self.db).emit(
+            event_type=EventType.RISK_ACTION_RECORDED,
+            source=EventSource.RISK,
+            aggregate_type=EventAggregateType.RISK_EVENT,
+            aggregate_id=record.id,
+            actor=actor,
+            payload={
+                EventPayloadKey.ACTION: action,
+                EventPayloadKey.STATUS: to_status,
+                EventPayloadKey.RECORD_ID: str(record.id),
+                RiskEventActionKey.FROM_STATUS: from_status,
+                RiskEventActionKey.TO_STATUS: to_status,
+                RiskEventActionKey.COMMENT: comment,
+                RiskEventActionKey.PAYLOAD: payload,
+            },
+            idempotency_key=f"risk:{record.id}:{action_record.code}",
+            dispatch=True,
+        )
         return action_record
 
     @staticmethod
@@ -328,6 +384,27 @@ class RiskService:
             RiskEventActionKey.ACTION_RECORD: serialize_model(action),
         }
 
+    def _consume_risk_approval(
+        self,
+        approval_ticket_id: str | None,
+        risk_event_id: int,
+        payload: dict[str, Any],
+        actor: str,
+    ) -> None:
+        if not approval_ticket_id:
+            raise HTTPException(
+                status_code=status.HTTP_409_CONFLICT,
+                detail=BusinessErrorDetail.HIGH_RISK_APPROVAL_REQUIRED,
+            )
+        ApprovalService(self.db).consume_for(
+            approval_ticket_id,
+            BusinessDomain.RISK_EVENTS,
+            risk_event_id,
+            approval_action(ApprovalActionValue.UPDATE, BusinessDomain.RISK_EVENTS),
+            payload,
+            actor,
+        )
+
     def generate_events(self, actor: str = ActorValue.API) -> dict[str, Any]:
         """Generate or refresh risk-event ledger entries from current signals."""