merge: 并入同事的场外申购/推广/行情/NL2SQL 线（11 提交、334 文件）

冲突仅 3 个文件，全部取并集（双方都没有需要丢弃的改动）：
- app/main.py：import 双方路由（我方 knowledge_management + 同事的 offsite_fund/
  promotion_material）；include_router 段本已自动合并
- app/service/agent/bootstrap.py：import 与工具注册均取并集
  （query_customer_profile + query_financial_data 都注册）
- tests/integration/test_config_release_mysql.py：outbox 清理同时保留
  架构师的 event_type 限定（防误删其它域 outbox 行）与同事新增的 peer_release_id

同事这轮带入：11 个 alembic 迁移（建 offsite_* / promotion_* 等表）、
场外申购与推广素材 Agent、financial NL2SQL 工具。
注意：本库尚无 offsite_*/promotion_* 表，跑相关测试前需要执行 alembic upgrade。

边界核对：同事的场外代码未写入场内交易表（fin_sim_order/fin_capital_flow/fin_cash_ledger），
符合 AGENTS.md 规则 8。

app/main.py

@@ -1,4 +1,6 @@
 from fastapi import FastAPI, Request
+from fastapi.exceptions import RequestValidationError
+from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
 
 from app.api.controllers.admin import router as admin_router
@@ -7,6 +9,9 @@ from app.api.controllers.conversations import router as conversations_router
 from app.api.controllers.health import router as health_router
 from app.api.controllers.knowledge import router as knowledge_router
 from app.api.controllers.knowledge_management import router as knowledge_management_router
+from app.api.controllers.offsite_fund import operation_router as offsite_operation_router
+from app.api.controllers.offsite_fund import router as offsite_fund_router
+from app.api.controllers.promotion_material import router as promotion_material_router
 from app.api.controllers.public_platform import router as public_platform_router
 from app.api.controllers.risk import router as risk_router
 from app.api.middleware import attach_trace_id
@@ -14,11 +19,37 @@ from app.core.config import get_settings
 from app.core.errors import AgentError
 
 
+def _trace_id(request: Request) -> str:
+    """取本次请求的追踪标识：请求上下文 → state → 客户端 `X-Trace-ID` → 空串。
+
+    没有就返回空字符串，绝不凭空生成——凭空生成会让客户端拿到的 trace_id 与服务端日志
+    里的不是同一个，反而失去定位价值。
+    """
+    context = getattr(request.state, "request_context", None)
+    return str(
+        getattr(context, "trace_id", None)
+        or getattr(request.state, "trace_id", None)
+        or request.headers.get("X-Trace-ID")
+        or ""
+    )
+
+
 def create_app() -> FastAPI:
     settings = get_settings()
     application = FastAPI(title=settings.app_name, version="0.1.0")
     # 接口文档承诺的 X-Trace-ID 此前完全没实现；中间件对成功与错误响应都生效。
     application.middleware("http")(attach_trace_id)
+    application.add_middleware(
+        CORSMiddleware,
+        allow_origins=[
+            origin.strip()
+            for origin in settings.cors_allowed_origins.split(",")
+            if origin.strip()
+        ],
+        allow_credentials=False,
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
 
     @application.exception_handler(AgentError)
     async def agent_error_handler(request: Request, exc: AgentError) -> JSONResponse:
@@ -42,10 +73,40 @@ def create_app() -> FastAPI:
                       "retryable": exc.is_retryable, "field_errors": []},
             "meta": {"trace_id": trace_id},
         }, headers=headers or None)
+    @application.exception_handler(RequestValidationError)
+    async def request_validation_error_handler(
+        request: Request, exc: RequestValidationError
+    ) -> JSONResponse:
+        """请求校验失败也必须走统一错误信封（文档 §3.4 / §3.6 `AGENT_INPUT_INVALID`）。
+
+        不加这个处理器时，FastAPI 会返回自己的 `{"detail": [...]}` 结构（422），客户端
+        必须为"参数错误"单独兼容一套解析逻辑；同一套接口因此出现两种错误体形态。
+        这里保留 422 状态码（文档 §3.5：已解析请求不满足字段或业务输入约束），
+        把字段级原因放进 `error.field_errors`，与业务异常的信封完全一致。
+        """
+        field_errors = [
+            {
+                "field": ".".join(str(part) for part in error.get("loc", ())),
+                "message": str(error.get("msg", "")),
+            }
+            for error in exc.errors()
+        ]
+        return JSONResponse(status_code=422, content={
+            "error": {
+                "code": "AGENT_INPUT_INVALID",
+                "message": "请求参数不满足接口约束",
+                "retryable": False,
+                "field_errors": field_errors,
+            },
+            "meta": {"trace_id": _trace_id(request)},
+        })
     application.include_router(agent_runs_router)
     application.include_router(conversations_router)
     application.include_router(public_platform_router)
     application.include_router(risk_router)
+    application.include_router(offsite_fund_router)
+    application.include_router(offsite_operation_router)
+    application.include_router(promotion_material_router)
     application.include_router(knowledge_router)
     application.include_router(knowledge_management_router)
     application.include_router(health_router)