同步完整源码至远程：扁平化重构现状 + 未入库源文件

- 补入库：server/internal/db/dump.go、redis 分页/扫描预算测试、opsxdb-mcp main_test、
  packages/opsxdb-mcp package-lock、docs 审计与对比文档等 37 个新文件
- 含结构扁平化进行中的 80 处修改与 155 处旧结构删除（server/ src/ src-tauri/ 为当前有效源）
- 构建产物（bin/target/dist）与签名私钥仍按规则排除

server/cmd/opsxdb-mcp/main_test.go

@@ -0,0 +1,46 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"opsxdb/server/internal/aitools"
+)
+
+func TestCallToolReloadsPolicyAndFailsClosed(t *testing.T) {
+	policy := aitools.Policy{Mode: aitools.ModeReadOnly, AllowedConnectionIDs: []string{"c1"}}
+	var loadErr error
+	load := func() (*aitools.Runtime, error) {
+		if loadErr != nil {
+			return nil, loadErr
+		}
+		rt := aitools.NewRuntime(policy)
+		rt.Audit = func(aitools.AuditEntry) {}
+		rt.LoadConns = func() ([]aitools.SavedConnection, error) {
+			return []aitools.SavedConnection{{ID: "c1"}, {ID: "c2"}}, nil
+		}
+		return rt, nil
+	}
+	list := func() ([]aitools.ConnectionSummary, error) {
+		out, err := callTool(context.Background(), aitools.ToolListConnections, nil, load)
+		if err != nil {
+			return nil, err
+		}
+		return out.(map[string]any)["connections"].([]aitools.ConnectionSummary), nil
+	}
+	first, err := list()
+	if err != nil || len(first) != 1 || first[0].ID != "c1" {
+		t.Fatalf("initial whitelist: %v, %v", first, err)
+	}
+	policy.AllowedConnectionIDs = []string{"c2"}
+	second, err := list()
+	if err != nil || len(second) != 1 || second[0].ID != "c2" {
+		t.Fatalf("updated whitelist: %v, %v", second, err)
+	}
+	loadErr = errors.New("invalid mcp.json")
+	if _, err := list(); err == nil || !strings.Contains(err.Error(), "invalid mcp.json") {
+		t.Fatalf("broken policy must reject calls, got %v", err)
+	}
+}