袁聪的第二次提交，项目已完整

app/api/controllers/admin.py

@@ -4,6 +4,7 @@ from fastapi import APIRouter, Depends, Header, Path, Query, Response
 from pydantic import BaseModel
 
 from app.api.dependencies.auth import build_request_context
+from app.api.dependencies.rate_limit import enforce_rate_limit
 from app.api.schemas.admin import (
     EmptyPayload,
     EndpointPayload,
@@ -19,7 +20,8 @@ from app.api.schemas.admin import (
 from app.core.contracts import RequestContext
 from app.service.admin_service import AdminService
 
-router = APIRouter(prefix="/api/v1/admin", tags=["platform-admin"])
+router = APIRouter(prefix="/api/v1/admin", tags=["platform-admin"],
+                   dependencies=[Depends(enforce_rate_limit)])
 
 
 def register_resource(
@@ -44,9 +46,13 @@ def register_resource(
 
     async def list_rows(
         release_id: int | None = None, limit: int = Query(default=20, ge=1, le=100),
+        cursor: str | None = Query(default=None),
         context: RequestContext = Depends(build_request_context),  # noqa: B008
     ) -> dict[str, Any]:
-        return await AdminService().query(resource, context, release_id=release_id, limit=limit)
+        """列表查询（文档 §3.8 统一游标）。游标校验在 Service 的权限闸门之后进行。"""
+        return await AdminService().query(
+            resource, context, release_id=release_id, limit=limit, cursor=cursor
+        )
 
     router.add_api_route(prefix, list_rows, methods=["GET"], operation_id=f"list_{resource}")
 
@@ -103,18 +109,24 @@ register_resource("platform-config-items", ItemPayload, "item_id", scoped=True,
 register_resource("model-endpoints", EndpointPayload, "endpoint_id")
 register_resource("model-routing-rules", RoutingPayload, "rule_id", scoped=True, detail=False)
 register_resource("prompt-templates", PromptPayload, "prompt_id", update=False)
-register_resource("agent-intent-configs", IntentPayload, "config_id", detail=False)
+register_resource("agent-intent-configs", IntentPayload, "config_id")
 register_resource("reply-templates", ReplyPayload, "template_id", detail=False)
 register_resource("negative-word-rules", NegativePayload, "rule_id", detail=False)
 for action in ("validations", "reviews", "activations", "rollbacks"):
     register_transition("config-releases", "release_id", action)
 for action in ("reviews", "activations", "disablements"):
     register_transition("model-endpoints", "endpoint_id", action)
+# 意图配置沿用同一套"审核 → 生效 → 归档"流转；归档落 `archived`
+# （该表 CHECK 约束只允许 draft/approved/active/archived，没有 disabled）。
+for action in ("reviews", "activations", "archivals"):
+    register_transition("agent-intent-configs", "config_id", action)
 
 
 @router.get("/audit-records")
 async def audit_records(
     limit: int = Query(default=20, ge=1, le=100),
+    cursor: str | None = Query(default=None),
     context: RequestContext = Depends(build_request_context),  # noqa: B008
 ) -> dict[str, Any]:
-    return await AdminService().query("audit-records", context, limit=limit)
+    """审计查询（文档 §9.6 支持游标过滤）。游标非法时返回 `400 INVALID_CURSOR`。"""
+    return await AdminService().query("audit-records", context, limit=limit, cursor=cursor)