收口 MNote P0 P1 P2 审查尾项

- 归档 OnlyOffice live bridge、Page AI、mindmap、design governance 与相关 bug 条目
- 补齐 MinerU OCR 后端 runtime 合同与 smoke/test 基线
- 收口 ChatOnly/Doubao、ObjectIdentity、Page Aggregate compat 与 runtime owner 文档口径

验证：
- cargo test --manifest-path rust/Cargo.toml -p mnote-web local_ocr -- --test-threads=1
- cargo test --manifest-path rust/Cargo.toml -p mnote-web onlyoffice_bridge -- --test-threads=1
- git diff --check
- git diff --cached --check
- codegraph index . --force && codegraph status .
- codegraph sync . && codegraph status .

rust/crates/control-plane/migrations/007-ai-agent-profile-policy.sql

@@ -0,0 +1,43 @@
+-- 007-ai-agent-profile-policy.sql
+-- Page AI agent profile policy: SQLite 是 profile 授权与归属真相层。
+
+CREATE TABLE IF NOT EXISTS ai_agent_profiles (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  profile_kind TEXT NOT NULL,
+  owner_user_id TEXT NOT NULL DEFAULT '',
+  base_profile_name TEXT NOT NULL,
+  isolated_profile_name TEXT NOT NULL,
+  display_name TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'active',
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  revision INTEGER NOT NULL DEFAULT 1,
+  UNIQUE(agent_id, profile_kind, owner_user_id, base_profile_name)
+);
+
+CREATE INDEX IF NOT EXISTS idx_ai_agent_profiles_agent
+  ON ai_agent_profiles(agent_id, status);
+
+CREATE INDEX IF NOT EXISTS idx_ai_agent_profiles_owner
+  ON ai_agent_profiles(owner_user_id, status);
+
+CREATE TABLE IF NOT EXISTS ai_agent_profile_grants (
+  id TEXT PRIMARY KEY,
+  profile_id TEXT NOT NULL REFERENCES ai_agent_profiles(id) ON DELETE CASCADE,
+  user_id TEXT NOT NULL DEFAULT '',
+  role TEXT NOT NULL,
+  can_run INTEGER NOT NULL DEFAULT 1,
+  can_manage_skills INTEGER NOT NULL DEFAULT 0,
+  can_manage_config INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  revision INTEGER NOT NULL DEFAULT 1,
+  UNIQUE(profile_id, user_id, role)
+);
+
+CREATE INDEX IF NOT EXISTS idx_ai_agent_profile_grants_profile
+  ON ai_agent_profile_grants(profile_id);
+
+CREATE INDEX IF NOT EXISTS idx_ai_agent_profile_grants_user
+  ON ai_agent_profile_grants(user_id);

rust/crates/control-plane/migrations/008-ai-external-conversation-bindings.sql

@@ -0,0 +1,28 @@
+CREATE TABLE IF NOT EXISTS ai_external_conversation_bindings (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    workspace_id TEXT,
+    mnote_session_id TEXT NOT NULL,
+    acp_session_id TEXT,
+    agent_id TEXT NOT NULL,
+    profile TEXT NOT NULL,
+    provider TEXT NOT NULL,
+    remote_conversation_id TEXT NOT NULL,
+    remote_url TEXT,
+    status TEXT NOT NULL DEFAULT 'active',
+    metadata_json TEXT NOT NULL DEFAULT '{}',
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+    deleted_at TEXT,
+    revision INTEGER NOT NULL DEFAULT 1,
+    CHECK (status IN ('active', 'local_deleted', 'remote_deleted', 'remote_delete_failed', 'remote_missing'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_ai_external_conv_user_session_provider
+ON ai_external_conversation_bindings(user_id, mnote_session_id, provider);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_ai_external_conv_user_provider_remote
+ON ai_external_conversation_bindings(user_id, provider, remote_conversation_id);
+
+CREATE INDEX IF NOT EXISTS idx_ai_external_conv_lookup
+ON ai_external_conversation_bindings(user_id, workspace_id, mnote_session_id, provider, status);