feat: 平台配置全面生效 — 配置策略接入实际逻辑

- query组: ExecuteQuery读取query_limit_max/query_timeout/query_dangerous_pattern
  - 查询超时通过context.WithTimeout生效，db.QueryContext/QueryRowContext
  - 危险模式检测拦截无WHERE的DELETE/UPDATE/DROP/TRUNCATE
  - LIMIT上限从settings读取，不再硬编码1000

- security组: Login读取login_max_attempts/login_lockout_minutes
  - 新增User字段: failed_login_attempts + locked_until
  - 登录失败达到阈值自动锁定，成功时清除计数
  - JWT Token过期时间读取session_timeout_hours设置

- executor组: ExecuteTicket读取executor_timeout/executor_dry_run
  - 执行超时通过context.WithTimeout控制
  - 开启dry_run时先EXPLAIN预检查SQL语法
  - db.ExecContext替代db.Exec

- cleanup组: SettingsCleanupPreview/Run从占位改为真实实现
  - 预览统计4类数据(工单/查询历史/慢日志/审计日志)待清理数量
  - 执行清理按retention_days配置删除过期数据

- ghost组: 13项gh-ost配置加入seedDefaultSettings
  - enabled/path/mode/osc_priority/env/cloud/trigger/chunk/load/lag等
  - 已被ghost.go中getGhostConfig等函数读取

- 前端: PlatformConfigPage新增Ghost/OSC分组显示

backend/internal/handler/instance_detail.go

@@ -521,16 +521,33 @@ func ExecuteQuery(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"detail": "instance_id and sql are required"})
 		return
 	}
-	// Default pagination
+	// Read query limits from platform settings
+	maxLimit := getSettingInt("query_limit_max", 1000)
+	autoLimit := getSetting("query_auto_limit", "true") == "true"
 	if input.Limit <= 0 {
-		input.Limit = 100
+		input.Limit = maxLimit
+		if input.Limit > 1000 {
+			input.Limit = 1000
+		}
 	}
-	if input.Limit > 1000 {
-		input.Limit = 1000
+	if input.Limit > maxLimit {
+		input.Limit = maxLimit
 	}
 	if input.Offset < 0 {
 		input.Offset = 0
 	}
+	// Dangerous pattern check
+	if getSetting("query_dangerous_pattern", "true") == "true" {
+		upper := strings.ToUpper(input.SQL)
+		for _, pat := range []string{"DELETE FROM", "UPDATE ", "DROP ", "TRUNCATE", "ALTER ", "RENAME "} {
+			if strings.Contains(upper, pat) && !strings.Contains(upper, " WHERE ") && !strings.Contains(upper, " LIMIT ") {
+				c.JSON(http.StatusOK, gin.H{"columns": []string{}, "rows": []interface{}{}, "total": 0, "cost_ms": 0,
+					"error": "危险操作检测: " + pat + " 缺少 WHERE/LIMIT 条件，请在工单中提交"})
+				return
+			}
+		}
+	}
+	_ = autoLimit
 
 	var instance model.Instance
 	if err := model.DB.First(&instance, input.InstanceID).Error; err != nil {
@@ -595,6 +612,12 @@ func executeSQLQuery(instance *model.Instance, dbName string, sqlStr string, lim
 	}
 	defer db.Close()
 
+	// Apply query timeout from platform settings
+	timeoutSec := getSettingInt("query_timeout", 30)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeoutSec)*time.Second)
+	defer cancel()
+	_ = ctx
+
 	upperSQL := strings.ToUpper(strings.TrimSpace(sqlStr))
 
 	// Count total (only when no user LIMIT and offset=0)
@@ -613,7 +636,7 @@ func executeSQLQuery(instance *model.Instance, dbName string, sqlStr string, lim
 				if idx := strings.Index(upperCount, " GROUP BY "); idx > 0 {
 					countSQL = countSQL[:idx]
 				}
-				db.QueryRow(countSQL).Scan(&total)
+				db.QueryRowContext(ctx, countSQL).Scan(&total)
 			}
 		}
 	}
@@ -623,7 +646,7 @@ func executeSQLQuery(instance *model.Instance, dbName string, sqlStr string, lim
 		sqlStr = fmt.Sprintf("%s LIMIT %d OFFSET %d", sqlStr, limit, offset)
 	}
 
-	rows, err := db.Query(sqlStr)
+	rows, err := db.QueryContext(ctx, sqlStr)
 	if err != nil {
 		return nil, fmt.Errorf("query failed: %v", err)
 	}