feat: 平台配置全面生效 — 配置策略接入实际逻辑

- query组: ExecuteQuery读取query_limit_max/query_timeout/query_dangerous_pattern
  - 查询超时通过context.WithTimeout生效，db.QueryContext/QueryRowContext
  - 危险模式检测拦截无WHERE的DELETE/UPDATE/DROP/TRUNCATE
  - LIMIT上限从settings读取，不再硬编码1000

- security组: Login读取login_max_attempts/login_lockout_minutes
  - 新增User字段: failed_login_attempts + locked_until
  - 登录失败达到阈值自动锁定，成功时清除计数
  - JWT Token过期时间读取session_timeout_hours设置

- executor组: ExecuteTicket读取executor_timeout/executor_dry_run
  - 执行超时通过context.WithTimeout控制
  - 开启dry_run时先EXPLAIN预检查SQL语法
  - db.ExecContext替代db.Exec

- cleanup组: SettingsCleanupPreview/Run从占位改为真实实现
  - 预览统计4类数据(工单/查询历史/慢日志/审计日志)待清理数量
  - 执行清理按retention_days配置删除过期数据

- ghost组: 13项gh-ost配置加入seedDefaultSettings
  - enabled/path/mode/osc_priority/env/cloud/trigger/chunk/load/lag等
  - 已被ghost.go中getGhostConfig等函数读取

- 前端: PlatformConfigPage新增Ghost/OSC分组显示

backend/internal/handler/ticket.go

@@ -549,6 +549,39 @@ func ExecuteTicket(c *gin.Context) {
 			execErr = fmt.Sprintf("DB connection failed: %v", err)
 		} else {
 			defer db.Close()
+			// Apply executor timeout from platform settings
+			execTimeout := getSettingInt("executor_timeout", 300)
+			ctx, cancel := context.WithTimeout(context.Background(), time.Duration(execTimeout)*time.Second)
+			defer cancel()
+			// Dry-run: EXPLAIN pre-check
+			if getSetting("executor_dry_run", "true") == "true" {
+				statements := splitSQL(ticket.SQLContent)
+				for _, stmt := range statements {
+					stmt = strings.TrimSpace(stmt)
+					if stmt == "" || strings.HasPrefix(strings.ToUpper(stmt), "EXPLAIN") {
+						continue
+					}
+					var explainRows []string
+					rows, err := db.QueryContext(ctx, "EXPLAIN "+stmt)
+					if err != nil {
+						execErr = fmt.Sprintf("预检查失败(EXPLAIN): %v", err)
+						break
+					}
+					for rows.Next() {
+						rows.Close()
+						break
+					}
+					_ = explainRows
+				}
+				if execErr != "" {
+					failStatus := "failed"
+					ticket.Status = &failStatus
+					ticket.ExecuteResult = &execErr
+					model.DB.Save(&ticket)
+					c.JSON(http.StatusOK, gin.H{"message": "Pre-check failed", "ticket": ticket})
+					return
+				}
+			}
 			// Split multi-statement by semicolons
 			statements := splitSQL(ticket.SQLContent)
 			var results []string
@@ -557,7 +590,7 @@ func ExecuteTicket(c *gin.Context) {
 				if stmt == "" {
 					continue
 				}
-				_, err := db.Exec(stmt)
+				_, err := db.ExecContext(ctx, stmt)
 				if err != nil {
 					results = append(results, fmt.Sprintf("[FAIL] %s: %v", truncateStr(stmt, 50), err))
 					// stop_on_error