feat: enforce tenant content moderation

server/db/mysql/admin_governance_schema.go

@@ -63,6 +63,18 @@ func ensureIMAdminGovernanceTables(exec sqlExecutor) error {
 			PRIMARY KEY(id), UNIQUE INDEX uk_im_user_ip_whitelist(user_id,ip_cidr),
 			INDEX idx_im_user_ip_whitelist_user(user_id,status), INDEX idx_im_user_ip_whitelist_deleted(deleted_at)
 		) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci`,
+		`CREATE TABLE IF NOT EXISTS im_content_moderation_logs (
+			id BIGINT NOT NULL AUTO_INCREMENT, request_id VARCHAR(64) NOT NULL,
+			scene VARCHAR(32) NOT NULL, topic VARCHAR(96) NOT NULL DEFAULT '', seqid BIGINT,
+			actor_id BIGINT, provider VARCHAR(32) NOT NULL DEFAULT '', provider_request_id VARCHAR(96) NOT NULL DEFAULT '',
+			risk_level VARCHAR(16) NOT NULL DEFAULT 'none', risk_labels JSON, action VARCHAR(16) NOT NULL,
+			content_hash CHAR(64) NOT NULL, latency_ms BIGINT NOT NULL DEFAULT 0, error_code VARCHAR(64) NOT NULL DEFAULT '',
+			created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3), PRIMARY KEY(id),
+			UNIQUE INDEX uk_im_content_moderation_request(request_id),
+			INDEX idx_im_content_moderation_scene_time(scene,created_at DESC,id DESC),
+			INDEX idx_im_content_moderation_actor_time(actor_id,created_at DESC,id DESC),
+			INDEX idx_im_content_moderation_topic_seq(topic,seqid)
+		) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci`,
 	}
 	for _, statement := range statements {
 		if _, err := exec.Exec(statement); err != nil {