同步完整源码至远程：扁平化重构现状 + 未入库源文件

- 补入库：server/internal/db/dump.go、redis 分页/扫描预算测试、opsxdb-mcp main_test、
  packages/opsxdb-mcp package-lock、docs 审计与对比文档等 37 个新文件
- 含结构扁平化进行中的 80 处修改与 155 处旧结构删除（server/ src/ src-tauri/ 为当前有效源）
- 构建产物（bin/target/dist）与签名私钥仍按规则排除

server/internal/aitools/runtime_test.go

@@ -80,6 +80,43 @@ func TestWhitelistEmptyRejects(t *testing.T) {
 	}
 }
 
+func TestAgentBoundToolsStayOnCurrentConnectionAndDatabase(t *testing.T) {
+	rt := NewRuntime(Policy{AllowedConnectionIDs: []string{"current", "other"}, Mode: ModeReadOnly})
+	rt.BoundConnectionID = "current"
+	rt.BoundDatabase = "demo"
+	rt.Audit = func(AuditEntry) {}
+	rt.FindConn = func(id string) (*SavedConnection, error) {
+		return &SavedConnection{ID: id, Name: id, Driver: "mysql", Database: "default"}, nil
+	}
+	rt.LoadConns = func() ([]SavedConnection, error) {
+		return []SavedConnection{{ID: "current"}, {ID: "other"}}, nil
+	}
+	var actualDatabase string
+	rt.ListTbl = func(_ context.Context, req db.ConnReq) ([]string, error) {
+		actualDatabase = req.Database
+		return []string{"users"}, nil
+	}
+	res, err := rt.Call(context.Background(), ToolListConnections, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := res.(map[string]any)["connections"].([]ConnectionSummary); len(got) != 1 || got[0].ID != "current" {
+		t.Fatalf("Agent should only see the bound connection: %+v", got)
+	}
+	for _, args := range []map[string]any{
+		{"connection_id": "other", "database": "demo"},
+		{"connection_id": "current", "database": "secret"},
+	} {
+		if _, err := rt.Call(context.Background(), ToolListTables, args); err == nil {
+			t.Fatalf("out-of-scope tool call was allowed: %+v", args)
+		}
+	}
+	_, err = rt.Call(context.Background(), ToolListTables, map[string]any{"connection_id": "current"})
+	if err != nil || actualDatabase != "demo" {
+		t.Fatalf("current database was not applied: database=%q err=%v", actualDatabase, err)
+	}
+}
+
 func TestDangerousSQLBlocked(t *testing.T) {
 	rt := NewRuntime(Policy{
 		AllowedConnectionIDs: []string{"c1"},