朱子纯 / xlyNewAi

…on dropped, form-level only via sAuthsId; Query security simplified

…Ai authorization layer; Read not permission-safe + param whitelist; invoke not backend-safe

…oseWrite covers mutating button-actions

… ERP procs, Query = ad-hoc-only

…; NL2SQL security pending investigation