feat: 平台配置全面生效 — 配置策略接入实际逻辑

- query组: ExecuteQuery读取query_limit_max/query_timeout/query_dangerous_pattern
  - 查询超时通过context.WithTimeout生效，db.QueryContext/QueryRowContext
  - 危险模式检测拦截无WHERE的DELETE/UPDATE/DROP/TRUNCATE
  - LIMIT上限从settings读取，不再硬编码1000

- security组: Login读取login_max_attempts/login_lockout_minutes
  - 新增User字段: failed_login_attempts + locked_until
  - 登录失败达到阈值自动锁定，成功时清除计数
  - JWT Token过期时间读取session_timeout_hours设置

- executor组: ExecuteTicket读取executor_timeout/executor_dry_run
  - 执行超时通过context.WithTimeout控制
  - 开启dry_run时先EXPLAIN预检查SQL语法
  - db.ExecContext替代db.Exec

- cleanup组: SettingsCleanupPreview/Run从占位改为真实实现
  - 预览统计4类数据(工单/查询历史/慢日志/审计日志)待清理数量
  - 执行清理按retention_days配置删除过期数据

- ghost组: 13项gh-ost配置加入seedDefaultSettings
  - enabled/path/mode/osc_priority/env/cloud/trigger/chunk/load/lag等
  - 已被ghost.go中getGhostConfig等函数读取

- 前端: PlatformConfigPage新增Ghost/OSC分组显示

backend/internal/handler/auth.go

@@ -29,6 +29,21 @@ func Login(c *gin.Context) {
 	var user model.User
 	err := model.DB.Where("username = ?", req.Username).First(&user).Error
 
+	// ── 登录失败锁定检查 ──
+	if err == nil && user.LockedUntil != nil && user.LockedUntil.After(time.Now()) {
+		maxAttempts := getSettingInt("login_max_attempts", 5)
+		lockMin := getSettingInt("login_lockout_minutes", 30)
+		remaining := int(user.LockedUntil.Sub(time.Now()).Minutes()) + 1
+		c.JSON(http.StatusTooManyRequests, gin.H{"detail": fmt.Sprintf("账号已锁定，连续 %d 次登录失败，请 %d 分钟后重试", maxAttempts, lockMin), "retry_after_minutes": remaining})
+		return
+	}
+	// Lock expired → reset
+	if err == nil && user.LockedUntil != nil && !user.LockedUntil.After(time.Now()) {
+		user.FailedLoginAttempts = 0
+		user.LockedUntil = nil
+		model.DB.Save(&user)
+	}
+
 	if err == nil {
 		// ── 本地用户存在 ──
 		if user.IsActive != nil && !*user.IsActive {
@@ -43,6 +58,8 @@ func Login(c *gin.Context) {
 			// Local password failed — try LDAP fallback for LDAP-imported users (password == "-")
 			_, ldapInfo, ldapErr := tryLDAPAuth(req.Username, req.Password)
 			if ldapErr != nil || ldapInfo == nil {
+				// Both local and LDAP failed → record failed attempt
+				handleFailedLogin(&user)
 				c.JSON(http.StatusUnauthorized, gin.H{"detail": "Invalid username or password"})
 				return
 			}
@@ -107,6 +124,9 @@ func Login(c *gin.Context) {
 	}
 
 	// ── 生成 Token ──
+	// Login success → reset failed attempts
+	user.FailedLoginAttempts = 0
+	user.LockedUntil = nil
 	token, err := middleware.GenerateToken(&user)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Failed to generate token"})
@@ -339,3 +359,16 @@ func DeleteUser(c *gin.Context) {
 	}
 	c.JSON(http.StatusOK, gin.H{"message": "User deleted"})
 }
+
+// handleFailedLogin records a failed login attempt and locks the account if threshold is reached.
+func handleFailedLogin(user *model.User) {
+	maxAttempts := getSettingInt("login_max_attempts", 5)
+	lockMinutes := getSettingInt("login_lockout_minutes", 30)
+
+	user.FailedLoginAttempts++
+	if user.FailedLoginAttempts >= maxAttempts {
+		lockedUntil := time.Now().Add(time.Duration(lockMinutes) * time.Minute)
+		user.LockedUntil = &lockedUntil
+	}
+	model.DB.Save(user)
+}