```

refactor(Dockerfile): 使用requirements.txt替代硬编码依赖

将Dockerfile中的硬编码pip包列表替换为通过requirements.txt文件安装，
提高依赖管理的灵活性和可维护性。

feat(scheduling): 移除内置APScheduler，采用独立调度系统

移除app/core/background/scheduler.py中原来的APScheduler实现，
改为使用新的应用级调度系统app.application.scheduling。

refactor(task_queue): 调整任务队列模块结构和导入路径

将任务队列相关常量从app.core.background.task_queue.constants迁移至
app.tasks.constants，并更新所有相关导入路径和引用。

refactor(events): 将事件服务重构为独立的应用层组件

将事件分发逻辑从核心层迁移到应用层，使用app.application.events.EventDispatchService
替代原有的app.modules.events.services.EventService。

feat(ai_memory): 增强AI记忆自动写入的安全策略

新增ai_memory_blocked_content_terms配置项用于阻止敏感内容，
添加TTL过期机制控制自动写入条目的生命周期。

fix(security): 强化生产环境安全验证机制

增加model_validator确保生产环境中数据库连接、API密钥、CORS设置等
关键安全配置符合要求。

feat(risks): 优化风险事件操作动作的外键约束

为RiskEventAction模型的风险事件ID字段添加外键约束，
防止孤立记录并增强数据完整性。

refactor(audit): 优化审计服务方法命名和事务处理

将AuditService的log方法重命名为record以反映其阶段行为，
并调整事务提交时机以提高性能。

feat(events): 增强领域事件并发处理和响应模型

添加事件锁定机制防止重复处理，更新API响应模型以提供
更准确的数据类型定义。
```

app/core/security/__init__.py

@@ -3,10 +3,18 @@ from app.core.security.operation_guard import (
     READ_ONLY_OPERATION_DISABLED,
     require_operations_enabled,
 )
+from app.core.security.operation_policy import (
+    OperationsDisabledError,
+    business_mutations_enabled,
+    ensure_business_mutations_enabled,
+)
 
 __all__ = [
     "ApiPrincipal",
+    "OperationsDisabledError",
     "READ_ONLY_OPERATION_DISABLED",
+    "business_mutations_enabled",
+    "ensure_business_mutations_enabled",
     "require_api_key",
     "require_audit_api_key",
     "require_operations_enabled",

app/core/security/operation_guard.py

@@ -1,6 +1,6 @@
 from fastapi import HTTPException, status
 
-from app.core.config import get_settings
+from app.core.security.operation_policy import business_mutations_enabled
 
 
 READ_ONLY_OPERATION_DISABLED = "This service is read-only; data mutation operations are disabled"
@@ -9,7 +9,7 @@ READ_ONLY_OPERATION_DISABLED = "This service is read-only; data mutation operati
 def require_operations_enabled(detail: str = READ_ONLY_OPERATION_DISABLED) -> None:
     """Reject mutation-oriented endpoints when the product is running read-only."""
 
-    if get_settings().read_only_mode:
+    if not business_mutations_enabled():
         raise HTTPException(
             status_code=status.HTTP_405_METHOD_NOT_ALLOWED,
             detail=detail,

app/core/security/operation_policy.py

@@ -0,0 +1,20 @@
+from app.core.config import get_settings
+
+
+class OperationsDisabledError(RuntimeError):
+    """Raised when a business mutation is attempted in read-only mode."""
+
+
+def business_mutations_enabled() -> bool:
+    """Return whether platform-owned business ledgers may be mutated."""
+
+    return not get_settings().read_only_mode
+
+
+def ensure_business_mutations_enabled() -> None:
+    """Enforce read-only policy outside the HTTP transport layer."""
+
+    if not business_mutations_enabled():
+        raise OperationsDisabledError(
+            "Business mutations are disabled while READ_ONLY_MODE is enabled"
+        )