Add TKMind platform extensions, H5/MindSpace stack, and deployment tooling.

Fork goose with custom MCP widgets, platform extensions (aider, git, web, search),
MindSpace H5 backend/frontend, Plaza/Ops UIs, and deploy scripts for tkmind.cn.

Co-authored-by: Cursor <cursoragent@cursor.com>

ui/h5/security-baseline.mjs

@@ -0,0 +1,58 @@
+import {
+  catalogKeys,
+  DEFAULT_USER_CAPABILITIES,
+  USER_NON_GRANTABLE_CAPABILITIES,
+} from './capabilities.mjs';
+import { DEFAULT_USER_POLICIES, policyKeys } from './policies.mjs';
+
+export function productionRoleCapabilities() {
+  return {
+    ...DEFAULT_USER_CAPABILITIES,
+    context_memory: false,
+    memory_store: false,
+    chat_recall: false,
+    charts: false,
+    todo: false,
+    image_read: true,
+  };
+}
+
+export function productionRolePolicies() {
+  return { ...DEFAULT_USER_POLICIES };
+}
+
+export async function applyRoleSecurityBaseline(pool, role = 'user') {
+  const now = Date.now();
+  const capabilities = productionRoleCapabilities();
+  for (const key of catalogKeys()) {
+    const allowed = USER_NON_GRANTABLE_CAPABILITIES.has(key)
+      ? false
+      : Boolean(capabilities[key]);
+    await pool.query(
+      `INSERT INTO h5_capability_grants (subject_type, subject_id, capability_key, allowed, updated_at)
+       VALUES ('role', ?, ?, ?, ?)
+       ON DUPLICATE KEY UPDATE allowed = VALUES(allowed), updated_at = VALUES(updated_at)`,
+      [role, key, allowed ? 1 : 0, now],
+    );
+  }
+
+  const policies = productionRolePolicies();
+  for (const key of policyKeys()) {
+    await pool.query(
+      `INSERT INTO h5_user_policies (subject_type, subject_id, policy_key, policy_value, updated_at)
+       VALUES ('role', ?, ?, ?, ?)
+       ON DUPLICATE KEY UPDATE policy_value = VALUES(policy_value), updated_at = VALUES(updated_at)`,
+      [role, key, String(policies[key]), now],
+    );
+  }
+}
+
+export async function clearUserPermissionOverrides(pool) {
+  await pool.query(`DELETE FROM h5_capability_grants WHERE subject_type = 'user'`);
+  await pool.query(`DELETE FROM h5_user_policies WHERE subject_type = 'user'`);
+}
+
+export async function applyProductionSecurityBaseline(pool) {
+  await applyRoleSecurityBaseline(pool, 'user');
+  await clearUserPermissionOverrides(pool);
+}