```

feat: 添加审批系统和遗留查询功能支持

- 添加审批系统，包括审批请求模型、服务和路由，支持创建、批准和拒绝操作
- 实现审批API密钥验证机制，区分普通API和审批API访问权限
- 添加Alembic数据库迁移支持，更新初始schema版本并添加降级保护
- 配置遗留MySQL查询白名单机制，支持命名查询和参数化查询
- 更新业务服务以集成审批流程，高风险操作需要审批票证
- 调整安全认证使用常量定义的HTTP头，增强安全性比较
- 优化.gitignore配置，添加日志目录排除和文档文件包含规则
- 更新Dockerfile添加alembic依赖包，修复OpenClaw适配器错误处理
```

app/core/config.py

@@ -1,4 +1,6 @@
+import json
 from functools import lru_cache
+from typing import Any
 
 from pydantic import Field, field_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
@@ -19,11 +21,14 @@ class Settings(BaseSettings):
     api_prefix: str = "/api/v1"
     api_key: str | None = None
     api_actor: str = ActorValue.API
+    approval_api_key: str | None = None
+    approval_api_actor: str = ActorValue.APPROVER
     cors_origins: list[str] = Field(default_factory=lambda: ["*"])
 
     database_url: str = "mysql+pymysql://root:password@127.0.0.1:3306/company_ai?charset=utf8mb4"
     legacy_database_url: str | None = None
     legacy_project_query: str | None = None
+    legacy_allowed_queries: dict[str, str] = Field(default_factory=dict)
     legacy_project_code_prefix: str = "LEGACY"
     redis_url: str = "redis://127.0.0.1:6379/0"
 
@@ -71,6 +76,20 @@ class Settings(BaseSettings):
             return value
         return [item.strip() for item in value.split(",") if item.strip()]
 
+    @field_validator("legacy_allowed_queries", mode="before")
+    @classmethod
+    def parse_legacy_allowed_queries(cls, value: Any) -> dict[str, str]:
+        if value is None or value == "":
+            return {}
+        if isinstance(value, dict):
+            return {str(key): str(item) for key, item in value.items()}
+        if isinstance(value, str):
+            data = json.loads(value)
+            if not isinstance(data, dict):
+                raise ValueError("LEGACY_ALLOWED_QUERIES must be a JSON object")
+            return {str(key): str(item) for key, item in data.items()}
+        raise ValueError("LEGACY_ALLOWED_QUERIES must be a JSON object")
+
 
 @lru_cache
 def get_settings() -> Settings: