```

feat: 添加审批系统和遗留查询功能支持

- 添加审批系统，包括审批请求模型、服务和路由，支持创建、批准和拒绝操作
- 实现审批API密钥验证机制，区分普通API和审批API访问权限
- 添加Alembic数据库迁移支持，更新初始schema版本并添加降级保护
- 配置遗留MySQL查询白名单机制，支持命名查询和参数化查询
- 更新业务服务以集成审批流程，高风险操作需要审批票证
- 调整安全认证使用常量定义的HTTP头，增强安全性比较
- 优化.gitignore配置，添加日志目录排除和文档文件包含规则
- 更新Dockerfile添加alembic依赖包，修复OpenClaw适配器错误处理
```

app/core/security.py

@@ -1,8 +1,10 @@
 from dataclasses import dataclass
+from secrets import compare_digest
 
 from fastapi import Header, HTTPException, status
 
 from app.core.config import get_settings
+from app.core.constants import HttpHeader
 
 
 @dataclass(frozen=True)
@@ -12,7 +14,9 @@ class ApiPrincipal:
     actor: str
 
 
-def require_api_key(x_api_key: str | None = Header(default=None)) -> ApiPrincipal:
+def require_api_key(
+    x_api_key: str | None = Header(default=None, alias=HttpHeader.X_API_KEY),
+) -> ApiPrincipal:
     """Validate the internal API key header and return its service principal."""
 
     settings = get_settings()
@@ -21,6 +25,31 @@ def require_api_key(x_api_key: str | None = Header(default=None)) -> ApiPrincipa
             status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
             detail="API_KEY is required",
         )
-    if x_api_key != settings.api_key:
+    if not x_api_key or not compare_digest(x_api_key, settings.api_key):
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid API key")
     return ApiPrincipal(actor=settings.api_actor)
+
+
+def require_approval_api_key(
+    x_approval_api_key: str | None = Header(
+        default=None,
+        alias=HttpHeader.X_APPROVAL_API_KEY,
+    ),
+) -> ApiPrincipal:
+    """Validate the approval API key and return the approval principal."""
+
+    settings = get_settings()
+    if not settings.approval_api_key:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="APPROVAL_API_KEY is required",
+        )
+    if (
+        not x_approval_api_key
+        or not compare_digest(x_approval_api_key, settings.approval_api_key)
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid approval API key",
+        )
+    return ApiPrincipal(actor=settings.approval_api_actor)