```

feat: 添加公司AI管理平台基础架构

添加了完整的FastAPI后端项目结构，包括：
- 环境配置文件(.env.example)和项目说明文档(README.md、AGENTS.md)
- Dockerfile用于容器化部署
- 核心基础设施：配置管理、数据库连接、调度器、安全认证
- 模块化设计：AI代理、审批流程、审计日志、业务台账等功能模块
- 支持多数据库连接(主库和遗留系统只读库)
- AI适配器支持OpenClaw、Hermes、OpenAI兼容接口
- 飞书集成、报表生成、风险监控等企业级功能
- 完整的依赖管理和测试指南
```

app/modules/approvals/service.py

@@ -0,0 +1,111 @@
+import json
+import uuid
+
+from fastapi import HTTPException, status
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.modules.approvals.models import ApprovalRequest
+from app.modules.approvals.schemas import ApprovalCreate
+from app.modules.audit.schemas import AuditLogCreate
+from app.modules.audit.service import AuditService
+
+
+class ApprovalService:
+    """Create, decide, and validate approval tickets for guarded actions."""
+
+    def __init__(self, db: Session):
+        self.db = db
+        self.audit = AuditService(db)
+
+    def create(self, payload: ApprovalCreate) -> ApprovalRequest:
+        ticket = ApprovalRequest(
+            ticket_id=f"APR-{uuid.uuid4().hex[:12].upper()}",
+            domain=payload.domain,
+            record_id=payload.record_id,
+            action=payload.action,
+            applicant=payload.applicant,
+            reason=payload.reason,
+            payload=json.dumps(payload.payload, ensure_ascii=False, default=str),
+        )
+        self.db.add(ticket)
+        self.db.commit()
+        self.db.refresh(ticket)
+        self.audit.log(
+            AuditLogCreate(
+                actor=payload.applicant,
+                source="approval",
+                action="approval.create",
+                target_type=payload.domain,
+                target_id=payload.record_id,
+                risk_level="medium",
+                request_payload=payload.model_dump(),
+                response_payload={"ticket_id": ticket.ticket_id, "status": ticket.status},
+            )
+        )
+        return ticket
+
+    def list(self, status_filter: str | None = None, limit: int = 100) -> list[ApprovalRequest]:
+        stmt = select(ApprovalRequest).order_by(ApprovalRequest.id.desc()).limit(min(limit, 500))
+        if status_filter:
+            stmt = stmt.where(ApprovalRequest.status == status_filter)
+        return list(self.db.execute(stmt).scalars())
+
+    def get_by_ticket(self, ticket_id: str) -> ApprovalRequest:
+        ticket = self.db.execute(
+            select(ApprovalRequest).where(ApprovalRequest.ticket_id == ticket_id)
+        ).scalar_one_or_none()
+        if ticket is None:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Approval ticket not found",
+            )
+        return ticket
+
+    def decide(
+        self,
+        ticket_id: str,
+        approver: str,
+        approved: bool,
+        comment: str | None,
+    ) -> ApprovalRequest:
+        ticket = self.get_by_ticket(ticket_id)
+        if ticket.status != "pending":
+            raise HTTPException(status_code=409, detail="Approval ticket already decided")
+        ticket.status = "approved" if approved else "rejected"
+        ticket.approver = approver
+        ticket.decision_comment = comment
+        from datetime import datetime
+
+        ticket.decided_at = datetime.utcnow()
+        self.db.commit()
+        self.db.refresh(ticket)
+        self.audit.log(
+            AuditLogCreate(
+                actor=approver,
+                source="approval",
+                action="approval.approve" if approved else "approval.reject",
+                target_type=ticket.domain,
+                target_id=ticket.record_id,
+                risk_level="high",
+                request_payload={"ticket_id": ticket_id, "comment": comment},
+                response_payload={"status": ticket.status},
+            )
+        )
+        return ticket
+
+    def is_approved_for(
+        self,
+        ticket_id: str,
+        domain: str,
+        record_id: str | int | None,
+        action: str,
+    ) -> bool:
+        ticket = self.get_by_ticket(ticket_id)
+        if ticket.status != "approved":
+            return False
+        if ticket.domain != domain:
+            return False
+        if ticket.record_id and record_id is not None and str(ticket.record_id) != str(record_id):
+            return False
+        return ticket.action in {action, "update", f"update:{domain}", "*"}