新增: 知识图谱Phase3基础设施(父⑥) — project_services+D10凭证审查+IPC+AI工具

父⑥ Phase 3(对标设计 §2.3):
- V31 迁移:project_services 表(id/project_id FK/name/service_type/endpoint/config_json/environment/remark)+ idx_project_services_project
- ProjectServiceRecord + ProjectServiceRepo(impl_repo! 宏 + insert_validated/update_full_validated/list_by_project/list_by_project_env)
- service_type 白名单(mysql/postgresql/sqlite/redis/mongodb/mq/api/other,应用层校验)
- D10 凭证审查:config_json/endpoint/remark 含 password/passwd/secret/api_key/apikey/token 拒绝(不存敏感凭证,凭证走环境变量)
- 4 IPC(add/update/remove/list_project_services,环境过滤)+ lib.rs 注册
- AI 工具 add/list_project_services(Medium/Low)+ 基线 39→41(data 25→27)+ 3 端到端测试

P2 修复(verify agent 发现):
- settings.rs project_services 白名单移除 service_type(对齐注释"不列入"+ status 收口,防 update_field 旁路绕过 validate_service_type)

df-storage 117(105+12) + df-ai 331 + 基线 41 测试全过。

crates/df-storage/src/crud/settings.rs

@@ -199,6 +199,15 @@ pub fn allowed_columns_for(table: &str) -> Option<&'static [&'static str]> {
         "knowledge_events" => &[
             "id", "knowledge_id", "event_type", "source_ref", "context_json", "timestamp",
         ],
+        // 知识图谱 Phase 3 V31(对标设计 §2.3):project_services 表有 updated_at,走 impl_repo! 宏
+        // 标准 CRUD(insert/get_by_id/list_all/query/update_field/update_full/delete),故登记白名单。
+        // id/created_at 不列入:主键与创建时间不可经通用 update_field 改写(对标 tasks/projects 防护)。
+        // service_type 不列入白名单(类比 status 收口思路):service_type 是类型枚举,变更应走整行
+        // update_full(过 service_type 应用层校验 + 凭证审查),而非 update_field 旁路绕过校验。
+        "project_services" => &[
+            "project_id", "name", "endpoint", "config_json", "environment",
+            "remark", "updated_at",
+        ],
         _ => return None,
     })
 }