```

feat: 添加审批系统和遗留查询功能支持

- 添加审批系统，包括审批请求模型、服务和路由，支持创建、批准和拒绝操作
- 实现审批API密钥验证机制，区分普通API和审批API访问权限
- 添加Alembic数据库迁移支持，更新初始schema版本并添加降级保护
- 配置遗留MySQL查询白名单机制，支持命名查询和参数化查询
- 更新业务服务以集成审批流程，高风险操作需要审批票证
- 调整安全认证使用常量定义的HTTP头，增强安全性比较
- 优化.gitignore配置，添加日志目录排除和文档文件包含规则
- 更新Dockerfile添加alembic依赖包，修复OpenClaw适配器错误处理
```

app/modules/legacy_mysql/schemas.py

@@ -3,12 +3,20 @@ from typing import Any
 from pydantic import BaseModel, Field
 
 from app.core.constants import ActorValue
+from app.modules.legacy_mysql.constants import LegacyQueryName
 
 
 class ReadonlyQueryRequest(BaseModel):
-    """Readonly SQL query request for the legacy MySQL connection."""
+    """Allowlisted readonly query request for the legacy MySQL connection."""
 
-    sql: str = Field(..., description="Readonly SELECT statement.")
+    query_name: str | None = Field(
+        default=LegacyQueryName.PROJECTS,
+        description="Configured readonly query name.",
+    )
+    sql: str | None = Field(
+        default=None,
+        description="Deprecated: must exactly match a configured readonly query.",
+    )
     params: dict[str, Any] = Field(default_factory=dict)
     limit: int = Field(default=100, ge=1, le=500)
 
@@ -32,7 +40,11 @@ class LegacyProjectSyncRequest(BaseModel):
 
     source_query: str | None = Field(
         default=None,
-        description="Optional SELECT query for project sync.",
+        description="Deprecated: must exactly match a configured readonly query.",
+    )
+    source_query_name: str | None = Field(
+        default=LegacyQueryName.PROJECTS,
+        description="Configured readonly query name for project sync.",
     )
     field_map: dict[str, str] = Field(
         default_factory=dict,