feat: add memindadm runtime policy for agent code runs (Phase 1.5)

Persist code-run gates in admin DB and expose them via /auth/status so H5 can honor runtime policy without VITE rebuilds.

Co-authored-by: Cursor <cursoragent@cursor.com>

admin-bootstrap.mjs

@@ -20,6 +20,7 @@ import { createAssetGatewayConfigService } from './asset-gateway.mjs';
 import { createImageMakeAdminConfigService } from './image-make-admin-config.mjs';
 import { createMemoryV2AdminConfigService } from './memory-v2-admin-config.mjs';
 import { createSkillRuntimeAdminConfigService } from './skill-runtime-admin-config.mjs';
+import { createAgentCodeRunAdminConfigService } from './agent-code-run-admin-config.mjs';
 import { createMindSearchConfigService } from './mindsearch-config.mjs';
 import { createWechatScheduleLlmConfigService } from './wechat-schedule-llm-config.mjs';
 import { createPlazaPostService, formatPostRow } from './plaza-posts.mjs';
@@ -111,6 +112,7 @@ export async function createAdminServices(env = {}) {
   const mindSearchConfigService = createMindSearchConfigService(pool);
   await mindSearchConfigService.ensureSchema();
   const skillRuntimeConfigService = createSkillRuntimeAdminConfigService(pool, { h5Root });
+  const agentCodeRunPolicyService = createAgentCodeRunAdminConfigService(pool, { env: process.env });
   const wechatScheduleLlmConfigService = createWechatScheduleLlmConfigService(pool);
   const adminSystemTestService = createAdminSystemTestService({
     pool,
@@ -152,6 +154,7 @@ export async function createAdminServices(env = {}) {
     memoryV2ConfigService,
     mindSearchConfigService,
     skillRuntimeConfigService,
+    agentCodeRunPolicyService,
     wechatScheduleLlmConfigService,
     adminSystemTestService,
     plazaPosts,