feat: ship loose-offline dbsync (validate, agent push, LWW audit)

Add UUID/FK channel checks, agent whitelist/push APIs, bindings, super-admin LWW audit with rollback, reconcile rate limits, and sync docs. Default customers stay opt-in; company conflict UI is removed.

Co-authored-by: Cursor <cursoragent@cursor.com>

platform/internal/dbsync/reconcile_limit.go

@@ -0,0 +1,30 @@
+package dbsync
+
+import (
+	"fmt"
+	"time"
+)
+
+// DefaultManualReconcileInterval 公司管理员手动对账最小间隔。
+const DefaultManualReconcileInterval = 5 * time.Minute
+
+// CanReconcile 限流：距上次对账不足 minInterval 则拒绝。
+func CanReconcile(ch *Channel, minInterval time.Duration) (bool, time.Duration) {
+	if ch == nil || ch.LastReconcileAt == nil || ch.LastReconcileAt.IsZero() {
+		return true, 0
+	}
+	if minInterval <= 0 {
+		minInterval = DefaultManualReconcileInterval
+	}
+	elapsed := time.Since(ch.LastReconcileAt.UTC())
+	if elapsed >= minInterval {
+		return true, 0
+	}
+	return false, minInterval - elapsed
+}
+
+// ReconcileTooSoonError 供 handler 返回 429。
+func ReconcileTooSoonError(wait time.Duration) error {
+	sec := int(wait.Seconds()) + 1
+	return fmt.Errorf("对账过于频繁，请 %d 秒后再试", sec)
+}