feat: Bot API L1-L4风险分级标注 + 操作审计日志

- 新增 app/risk_levels.py: RISK_LEVELS定义 + @risk_level装饰器 + API_RISK_MAP
  (L1只读21 / L2业务写5 / L3批量写3 / L4=0安全底线)
- 新增 app/api/audit_log.py: Bot API审计中间件 → backend/logs/bot_audit.log
  (JSON行: timestamp/bot_name/endpoint/method/risk_level/entity_id/status,
   L3额外记rows行数, 不阻塞业务)
- bot_bridge/bot_bridge_v2/bot_kpis/bot_iron_law 全部29路由标注级别
- 新增 GET /api/cma/bot/risk-levels (X-BOT-KEY鉴权): API→级别→处理方式清单
- main.py 注册审计中间件
- tests/test_risk_levels.py: 覆盖路由标注/risk-levels端点/L4不存在/审计日志

backend/app/api/bot_bridge_v2.py

@@ -23,6 +23,7 @@ from app.models import (
     KPIDefinition, KPIValue, KPIAlert,
     ActionPlan, Entity,
 )
+from app.risk_levels import risk_level
 
 logger = logging.getLogger("cma.bot_bridge_v2")
 
@@ -279,6 +280,7 @@ ALERT_THRESHOLDS = {
 # ═══════════════════════════════════════════════
 
 @router.post("/mpm-result")
+@risk_level("L3")
 def receive_mpm_result(
     data: dict,
     bridge_bot: str = Depends(verify_bridge_token),
@@ -404,6 +406,7 @@ def receive_mpm_result(
 
 
 @router.post("/kpi-result")
+@risk_level("L2")
 def push_kpi_result(
     data: dict,
     bridge_bot: str = Depends(verify_bridge_token),
@@ -521,6 +524,7 @@ def push_kpi_result(
 
 
 @router.post("/verify/{action_plan_id}")
+@risk_level("L2")
 def verify_action_plan(
     action_plan_id: int,
     bridge_bot: str = Depends(verify_bridge_token),
@@ -599,6 +603,7 @@ def verify_action_plan(
 
 
 @router.get("/verify/{action_plan_id}/history")
+@risk_level("L1")
 def verify_history(
     action_plan_id: int,
     bridge_bot: str = Depends(verify_bridge_token),