feat: harden loose-offline sync for user JWT, schema, and console ops

Enable Binding-scoped agent push/pull, empty-table schema ensure, SyncPage inspect/drop-table, default module import, and agent-bound publish docs from the 宇恒联调意见.

Co-authored-by: Cursor <cursoragent@cursor.com>

platform/internal/handler/sync_binding.go

@@ -17,7 +17,16 @@ func syncBindingsListHandler(svcCtx *svc.ServiceContext) http.HandlerFunc {
 			return
 		}
 		localID := r.URL.Query().Get("local_database_id")
-		list, err := svcCtx.DBSync.Store().ListBindings(syncTenantID(r), localID)
+		tid := syncTenantID(r)
+		var (
+			list []dbsync.Binding
+			err  error
+		)
+		if authx.SyncTenantWide(r.Context()) {
+			list, err = svcCtx.DBSync.Store().ListBindings(tid, localID)
+		} else {
+			list, err = svcCtx.DBSync.Store().ListBindingsFiltered(tid, authx.UserID(r.Context()), localID)
+		}
 		if err != nil {
 			authx.WriteError(w, http.StatusBadRequest, err.Error())
 			return
@@ -37,8 +46,14 @@ func syncBindingsEnsureHandler(svcCtx *svc.ServiceContext) http.HandlerFunc {
 			return
 		}
 		body.TenantID = syncTenantID(r)
-		if body.UserID == 0 {
-			body.UserID = authx.UserID(r.Context())
+		uid := authx.UserID(r.Context())
+		if authx.SyncTenantWide(r.Context()) {
+			if body.UserID == 0 {
+				body.UserID = uid
+			}
+		} else {
+			// 用户自助：强制绑定到本人，禁止冒用他人 user_id
+			body.UserID = uid
 		}
 		saved, err := svcCtx.DBSync.Store().EnsureBinding(body)
 		if err != nil {