feat(db): add author-only approval policy revision and audit

Seed workflow.allow_author_only_approval closed, add monotonic
revision on system_settings, and a narrow policy audit table.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/postgres/goose/00050_2026-09-17-workflow-author-only-policy.sql

@@ -0,0 +1,30 @@
+-- +goose Up
+-- 编制人兼任总授权：system_settings 增加 monotonic revision；种子目标 key；策略变更审计（仅本策略必需）。
+
+ALTER TABLE system_settings
+    ADD COLUMN IF NOT EXISTS revision BIGINT NOT NULL DEFAULT 0;
+
+CREATE TABLE IF NOT EXISTS system_setting_policy_audits (
+    id               BIGSERIAL PRIMARY KEY,
+    setting_key      TEXT NOT NULL,
+    before_value     JSONB,
+    after_value      JSONB NOT NULL,
+    before_revision  BIGINT,
+    after_revision   BIGINT NOT NULL,
+    actor_user_id    BIGINT NOT NULL,
+    request_id       TEXT,
+    created_at       TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_system_setting_policy_audits_key_created
+    ON system_setting_policy_audits (setting_key, created_at DESC);
+
+-- 初始化目标行，避免激活事务对缺失行拿不到行锁。
+INSERT INTO system_settings (key, value, revision, updated_at)
+VALUES ('workflow.allow_author_only_approval', 'false'::jsonb, 0, now())
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DELETE FROM system_settings WHERE key = 'workflow.allow_author_only_approval';
+DROP TABLE IF EXISTS system_setting_policy_audits;
+ALTER TABLE system_settings DROP COLUMN IF EXISTS revision;