feat: Phase 3 - AES encryption, SQL audit engine, audit logs (85 tests)

Phase 3.1: Instance password AES-256-GCM encryption
Phase 3.2: SQL audit rule engine (10 rules)
Phase 3.3: Auto-audit on ticket creation
Phase 3.4: Operation audit logs + GET /audit/logs
Tests: 44 -> 85 (41 new), Frontend: AuditLogsPage

backend/app/api/v1/endpoints/ticket.py

@@ -11,6 +11,10 @@ from app.models.user import User
 from app.models.ticket import Ticket
 from app.models.instance import Instance
 from app.schemas.ticket import TicketCreate, TicketReview, TicketResponse
+from app.core.crypto import decrypt_password
+from app.services.audit_engine import SQLAuditEngine
+from app.services.audit_log_service import AuditLogService
+import json
 
 router = APIRouter(prefix="/tickets", tags=["工单管理"])
 
@@ -104,6 +108,10 @@ async def create_ticket(
     if not inst.scalar_one_or_none():
         raise HTTPException(status_code=400, detail="数据源不存在")
 
+    # Auto-audit SQL before creating ticket
+    engine = SQLAuditEngine(env="production" if data.db_type == "mysql" else "development")
+    report = engine.audit(data.sql_content)
+
     ticket = Ticket(
         title=data.title,
         db_type=data.db_type,
@@ -115,11 +123,23 @@ async def create_ticket(
         priority=data.priority,
         applicant_id=current_user.id,
         status="pending",
+        audit_result=json.dumps(report.to_dict(), ensure_ascii=False) if report.findings else None,
     )
     db.add(ticket)
+    await db.flush()  # flush to get ticket.id for audit log
+
+    # Log ticket creation
+    await AuditLogService.log(
+        db, user_id=current_user.id, action="CREATE_TICKET",
+        target_type="ticket", target_id=ticket.id,
+        detail=f"SQL审核评分: {report.score}, 通过: {report.passed}",
+    )
+
     await db.commit()
     await db.refresh(ticket)
-    return await _enrich_ticket(ticket, db)
+    result = await _enrich_ticket(ticket, db)
+    result["audit_report"] = report.to_dict()
+    return result
 
 
 @router.get("/statistics")
@@ -184,6 +204,13 @@ async def review_ticket(
     ticket.approver_id = current_user.id
     ticket.review_time = datetime.now(timezone.utc)
     ticket.audit_result = data.comment
+
+    await AuditLogService.log(
+        db, user_id=current_user.id, action="REVIEW_TICKET",
+        target_type="ticket", target_id=ticket.id,
+        detail=f"审核动作: {data.action}, 备注: {data.comment}",
+    )
+
     await db.commit()
     await db.refresh(ticket)
     return await _enrich_ticket(ticket, db)
@@ -213,6 +240,7 @@ async def execute_ticket(
             raise HTTPException(status_code=400, detail="数据源不存在")
 
         from app.services.query_service import QueryService
+        instance.password = decrypt_password(instance.password)
         exec_result = await QueryService.execute_dml(instance, ticket.target_database, ticket.sql_content)
 
         ticket.status = "success"