feat: 数据脱敏体系重构 — 全局设置+masked_columns+前端去硬编码

后端:
- applyDataMasking 新增 masked_columns 返回字段，告诉前端哪些列被脱敏
- seedDefaultSettings 添加 data_masking 分组(启用开关+敏感字段列表)
- 脱敏逻辑: 全局敏感字段 + 实例级 mask_fields 合并，开关关闭则跳过

前端:
- QueriesPage 去掉硬编码 sensitiveKeywords 和 maskData()
- 改用后端返回的 masked_columns 显示'敏'标签
- 脱敏值由后端统一处理(替换为*)
- PlatformConfigPage 数据脱敏分组独立显示
- EditInstanceDialog 脱敏字段简化为逗号分隔输入

验证:
- 设置页开关可正常开关/保存
- 查询 ghost_test: email列被脱敏为*，列头显示'敏'标签
- 非敏感列(name, id, status)正常显示

backend/internal/handler/instance_detail.go

@@ -550,6 +550,7 @@ func ExecuteQuery(c *gin.Context) {
 		}
 		result["cost_ms"] = costMs
 		rowsInterface, _ := result["rows"].([]interface{})
+		applyDataMasking(result, &instance)
 		saveQueryHistory(userID, input.InstanceID, input.Database, input.SQL, costMs, len(rowsInterface))
 		c.JSON(http.StatusOK, result)
 
@@ -565,6 +566,7 @@ func ExecuteQuery(c *gin.Context) {
 		if rowsArr, ok := result["rows"].([]interface{}); ok {
 			rowCount = len(rowsArr)
 		}
+		applyDataMasking(result, &instance)
 		saveQueryHistory(userID, input.InstanceID, input.Database, input.SQL, costMs, rowCount)
 		c.JSON(http.StatusOK, result)
 
@@ -577,6 +579,7 @@ func ExecuteQuery(c *gin.Context) {
 		}
 		result["cost_ms"] = costMs
 		rowsInterface, _ := result["rows"].([]interface{})
+		applyDataMasking(result, &instance)
 		saveQueryHistory(userID, input.InstanceID, input.Database, input.SQL, costMs, len(rowsInterface))
 		c.JSON(http.StatusOK, result)
 
@@ -1316,3 +1319,101 @@ func saveQueryHistory(userID int, instanceID int, database string, sqlStr string
 	}
 	model.DB.Create(&history)
 }
+
+// applyDataMasking masks sensitive fields in query results with "*".
+// It reads global settings (data_masking_enabled + sensitive fields) and
+// merges with instance-level mask_fields.
+func applyDataMasking(result gin.H, instance *model.Instance) {
+	// Check global enable flag
+	var enabledSetting model.SystemSetting
+	if model.DB.Where("`key` = ?", "data_masking_enabled").First(&enabledSetting).Error != nil {
+		return // setting not found, skip masking
+	}
+	if enabledSetting.Value != "true" {
+		return // masking disabled
+	}
+
+	// Collect global sensitive fields
+	var fieldsSetting model.SystemSetting
+	globalFields := map[string]bool{}
+	if model.DB.Where("`key` = ?", "data_masking_sensitive_fields").First(&fieldsSetting).Error == nil {
+		for _, f := range strings.Split(fieldsSetting.Value, ",") {
+			f = strings.TrimSpace(f)
+			if f != "" {
+				globalFields[strings.ToLower(f)] = true
+			}
+		}
+	}
+
+	// Merge instance-level mask_fields
+	instanceFields := map[string]bool{}
+	if instance.MaskFields != nil && *instance.MaskFields != "" {
+		for _, f := range strings.Split(*instance.MaskFields, ",") {
+			f = strings.TrimSpace(f)
+			if f != "" {
+				instanceFields[strings.ToLower(f)] = true
+			}
+		}
+	}
+
+	// Combine all mask fields
+	allMaskFields := make(map[string]bool)
+	for k := range globalFields {
+		allMaskFields[k] = true
+	}
+	for k := range instanceFields {
+		allMaskFields[k] = true
+	}
+
+	if len(allMaskFields) == 0 {
+		return
+	}
+
+	// Apply masking to rows and collect masked column names
+	rows, ok := result["rows"].([]interface{})
+	if !ok {
+		return
+	}
+	maskedCols := []string{}
+	for _, rowIface := range rows {
+		row, ok := rowIface.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		for colName, val := range row {
+			if allMaskFields[strings.ToLower(colName)] {
+				row[colName] = maskValue(val)
+				// Track masked column (deduplicate)
+				found := false
+				for _, mc := range maskedCols {
+					if mc == colName {
+						found = true
+						break
+					}
+				}
+				if !found {
+					maskedCols = append(maskedCols, colName)
+				}
+			}
+		}
+	}
+	if len(maskedCols) > 0 {
+		result["masked_columns"] = maskedCols
+	}
+}
+
+// maskValue replaces a value with asterisks, preserving length info for strings
+func maskValue(val interface{}) string {
+	if val == nil {
+		return "***"
+	}
+	s := fmt.Sprintf("%v", val)
+	if len(s) == 0 {
+		return "*"
+	}
+	// Replace all chars with *, keep reasonable length
+	if len(s) > 20 {
+		return "********************"
+	}
+	return strings.Repeat("*", len(s))
+}