feat: 数据脱敏体系重构 — 全局设置+masked_columns+前端去硬编码

后端:
- applyDataMasking 新增 masked_columns 返回字段，告诉前端哪些列被脱敏
- seedDefaultSettings 添加 data_masking 分组(启用开关+敏感字段列表)
- 脱敏逻辑: 全局敏感字段 + 实例级 mask_fields 合并，开关关闭则跳过

前端:
- QueriesPage 去掉硬编码 sensitiveKeywords 和 maskData()
- 改用后端返回的 masked_columns 显示'敏'标签
- 脱敏值由后端统一处理(替换为*)
- PlatformConfigPage 数据脱敏分组独立显示
- EditInstanceDialog 脱敏字段简化为逗号分隔输入

验证:
- 设置页开关可正常开关/保存
- 查询 ghost_test: email列被脱敏为*，列头显示'敏'标签
- 非敏感列(name, id, status)正常显示

frontend/src/components/EditInstanceDialog.tsx

@@ -1,5 +1,5 @@
 import { useState, useCallback, useEffect } from 'react';
-import { X, Loader2, Plus, Trash2 } from 'lucide-react';
+import { X, Loader2 } from 'lucide-react';
 import { instanceApi } from '@/api/instance';
 import { workflowApi } from '@/api/workflow';
 
@@ -19,7 +19,7 @@ interface InstanceData {
   workflow_id?: number | null;
   workflow_name?: string | null;
   excluded_databases?: string[] | null;
-  mask_fields?: { table: string; field: string; rule: string }[] | null;
+  mask_fields?: string | null;
   group_id?: number | null;
 }
 
@@ -52,11 +52,11 @@ export default function EditInstanceDialog({ instance, open, onClose, onSaved, m
   const [workflowId, setWorkflowId] = useState<number | null>(instance.workflow_id || null);
   const [workflows, setWorkflows] = useState<WorkflowItem[]>([]);
   // excluded_databases: comma-separated input
-  const [excludedDbs, setExcludedDbs] = useState((instance.excluded_databases || []).join(', '));
-  // mask_fields
-  const [maskFields, setMaskFields] = useState<{ table: string; field: string; rule: string }[]>(
-    instance.mask_fields && instance.mask_fields.length > 0 ? instance.mask_fields : []
+  const [excludedDbs, setExcludedDbs] = useState(
+    Array.isArray(instance.excluded_databases) ? (instance.excluded_databases as string[]).join(', ') : (instance.excluded_databases || '')
   );
+  // mask_fields: comma-separated field names
+  const [maskFields, setMaskFields] = useState(instance.mask_fields || '');
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState('');
 
@@ -71,8 +71,10 @@ export default function EditInstanceDialog({ instance, open, onClose, onSaved, m
     setEnv(instance.env || 'development');
     setAccessMode(instance.access_mode || 'readwrite');
     setWorkflowId(instance.workflow_id || null);
-    setExcludedDbs((instance.excluded_databases || []).join(', '));
-    setMaskFields(instance.mask_fields && instance.mask_fields.length > 0 ? instance.mask_fields : []);
+    setExcludedDbs(
+      Array.isArray(instance.excluded_databases) ? (instance.excluded_databases as string[]).join(', ') : (instance.excluded_databases || '')
+    );
+    setMaskFields(instance.mask_fields || '');
     setError('');
   }, [instance]);
 
@@ -86,14 +88,6 @@ export default function EditInstanceDialog({ instance, open, onClose, onSaved, m
     }
   }, [open]);
 
-  const addMaskField = () => setMaskFields([...maskFields, { table: '', field: '', rule: 'mask' }]);
-  const removeMaskField = (idx: number) => setMaskFields(maskFields.filter((_, i) => i !== idx));
-  const updateMaskField = (idx: number, key: string, value: string) => {
-    const next = [...maskFields];
-    next[idx] = { ...next[idx], [key]: value };
-    setMaskFields(next);
-  };
-
   const handleSubmit = useCallback(async () => {
     if (!name.trim()) { setError('请填写名称'); return; }
     if (!host.trim()) { setError('请填写地址'); return; }
@@ -102,9 +96,6 @@ export default function EditInstanceDialog({ instance, open, onClose, onSaved, m
       const parsedExcluded = excludedDbs.trim()
         ? excludedDbs.split(',').map(s => s.trim()).filter(Boolean)
         : undefined;
-      const parsedMask = maskFields.some(m => m.table && m.field)
-        ? maskFields.filter(m => m.table && m.field)
-        : undefined;
 
       const payload: Record<string, unknown> = {
         name: name.trim(),
@@ -116,7 +107,7 @@ export default function EditInstanceDialog({ instance, open, onClose, onSaved, m
         access_mode: accessMode,
         workflow_id: workflowId,
         excluded_databases: parsedExcluded,
-        mask_fields: parsedMask,
+        mask_fields: maskFields.trim() || undefined,
       };
       if (mode === 'clone') {
         payload.db_type = instance.db_type;
@@ -232,33 +223,20 @@ export default function EditInstanceDialog({ instance, open, onClose, onSaved, m
             <input className={inputCls} value={excludedDbs} onChange={e => setExcludedDbs(e.target.value)} placeholder="sys, information_schema, mysql" />
           </div>
 
-          {/* 脱敏字段 */}
+          {/* 脱敏字段 - 简化为逗号分隔输入 */}
           <div>
-            <div className="flex items-center justify-between mb-1">
-              <label className={labelCls}>脱敏字段</label>
-              <button onClick={addMaskField} className="text-xs text-blue-400 hover:text-blue-300 flex items-center gap-1">
-                <Plus className="w-3 h-3" /> 添加
-              </button>
-            </div>
-            {maskFields.length === 0 && (
-              <div className="text-xs text-[var(--dg-text-muted)] py-2">未配置脱敏规则</div>
-            )}
-            <div className="space-y-2">
-              {maskFields.map((mf, idx) => (
-                <div key={idx} className="flex items-center gap-2">
-                  <input className="flex-1 px-2 py-1.5 bg-[var(--dg-bg-tertiary)] border border-[var(--dg-border)] rounded text-xs focus:border-blue-400 focus:outline-none" value={mf.table} onChange={e => updateMaskField(idx, 'table', e.target.value)} placeholder="表名" />
-                  <input className="flex-1 px-2 py-1.5 bg-[var(--dg-bg-tertiary)] border border-[var(--dg-border)] rounded text-xs focus:border-blue-400 focus:outline-none" value={mf.field} onChange={e => updateMaskField(idx, 'field', e.target.value)} placeholder="字段名" />
-                  <select className="w-20 px-2 py-1.5 bg-[var(--dg-bg-tertiary)] border border-[var(--dg-border)] rounded text-xs focus:border-blue-400 focus:outline-none" value={mf.rule} onChange={e => updateMaskField(idx, 'rule', e.target.value)}>
-                    <option value="mask">遮盖</option>
-                    <option value="hide">隐藏</option>
-                    <option value="hash">哈希</option>
-                  </select>
-                  <button onClick={() => removeMaskField(idx)} className="p-1 text-[var(--dg-text-muted)] hover:text-red-400">
-                    <Trash2 className="w-3.5 h-3.5" />
-                  </button>
-                </div>
-              ))}
-            </div>
+            <label className={labelCls}>
+              自定义脱敏字段 <span className="font-normal text-[var(--dg-text-muted)]">（逗号分隔，与全局敏感字段合并，如 id_card, address）</span>
+            </label>
+            <input
+              className={inputCls}
+              value={maskFields}
+              onChange={e => setMaskFields(e.target.value)}
+              placeholder="id_card, address, bank_account"
+            />
+            <p className="text-xs text-[var(--dg-text-muted)] mt-1">
+              仅需添加此实例特有的脱敏字段，全局敏感字段（mobile, email 等）已在系统设置中统一配置
+            </p>
           </div>
         </div>