修复: 安全加固+DRY 收敛+文档同步+测试补齐

安全:
- ScriptNode 默认黑名单兜底(rm/del/format/shutdown/mkfs/dd)
- bind_directory 分段 .. 检测替代 contains 子串(对齐 tool_registry)
- ai_providers 白名单移除 api_key(防 update_field 旁路写明文)

DRY:
- useAiEvents 抽 cleanupTerminatedConversation 统一三分支收尾
- 新增 useStoreAction 工具,4 个 store 替换 38 处 try/catch 样板

文档:
- df-core → df-types 批量替换(ARCHITECTURE/PROGRESS/SQLite-CRUD)
- INDEX 补齐 9 漏列文档(单对话并行多轮/跑题试验/工程系统设计等)
- Agent架构说明 死链修复(../构想审查/)
- AI对话引擎工具清单改为数量+按风险分组(不再用固定数字)
- ARCH 状态标签 设计阶段 → Phase 2 验证

测试:
- df-relay 新增 registry_test: ConnRegistry 路由 + RelayState + 16 项单测

crates/df-storage/src/crud/settings.rs

@@ -180,8 +180,10 @@ pub fn allowed_columns_for(table: &str) -> Option<&'static [&'static str]> {
             "id", "workflow_id", "node_id", "node_type", "status", "input_json", "output_json",
             "error_message", "started_at", "completed_at",
         ],
+        // api_key 不列入白名单:密钥写入应只走 update_full/insert + keyring 配套,
+        // 禁止 update_field 旁路绕过 keyring(防明文写回 DB)。
         "ai_providers" => &[
-            "id", "name", "provider_type", "api_key", "base_url", "default_model", "models",
+            "id", "name", "provider_type", "base_url", "default_model", "models",
             "is_default", "config", "created_at", "updated_at",
         ],
         "ai_conversations" => &[