```

feat: 添加审批系统和遗留查询功能支持

- 添加审批系统，包括审批请求模型、服务和路由，支持创建、批准和拒绝操作
- 实现审批API密钥验证机制，区分普通API和审批API访问权限
- 添加Alembic数据库迁移支持，更新初始schema版本并添加降级保护
- 配置遗留MySQL查询白名单机制，支持命名查询和参数化查询
- 更新业务服务以集成审批流程，高风险操作需要审批票证
- 调整安全认证使用常量定义的HTTP头，增强安全性比较
- 优化.gitignore配置，添加日志目录排除和文档文件包含规则
- 更新Dockerfile添加alembic依赖包，修复OpenClaw适配器错误处理
```

tests/test_ai_adapters.py

@@ -208,3 +208,32 @@ def test_openclaw_adapter_blocks_tools_not_in_allowlist(monkeypatch) -> None:
 
     assert exc_info.value.status_code == 403
     assert DummyClient.calls == []
+
+
+def test_openclaw_hermes_adapter_fails_when_requested_tool_is_blocked(monkeypatch) -> None:
+    DummyClient.calls = []
+    monkeypatch.setattr(adapters.httpx, "Client", DummyClient)
+    settings = Settings(
+        model_provider="openclaw_hermes",
+        openclaw_http_url="http://openclaw.local",
+        openclaw_gateway_token="openclaw-key",
+        openclaw_allowed_tools=["sessions_list"],
+        hermes_base_url="http://hermes.local/v1",
+        hermes_api_key="hermes-key",
+    )
+
+    with pytest.raises(HTTPException) as exc_info:
+        adapters.OpenClawHermesAdapter(settings).ask(
+            "write through gateway",
+            {
+                AIContextKey.OPENCLAW_TOOL: "filesystem_write",
+                AIContextKey.OPENCLAW_ARGS: {"path": "/tmp/x"},
+            },
+        )
+
+    assert exc_info.value.status_code == 403
+    assert [call["url"] for call in DummyClient.calls] == [
+        "http://hermes.local/v1/chat/completions",
+        "http://openclaw.local/healthz",
+        "http://openclaw.local/readyz",
+    ]