feat(套餐真流量预警): AUG26-004 真流量预警规则、达量扫描通知与导出

新增 000228 迁移：规则表 tb_package_traffic_alert_rule（每套餐商品至多一条，无软删除，package_id
非部分唯一约束）、达量预警快照表 tb_package_traffic_alert（以主套餐使用记录 + 阈值快照为唯一键，
触发时冻结用量、额度、比例、阈值、到期时间、归属与资产快照），并为 tb_package_usage 新增扫描
范围部分索引 idx_package_usage_alert_scope；down 在预警表存在数据时阻断回滚。

新增规则维护接口 GET/POST/PUT /api/admin/package-traffic-alert-rules（仅超级管理员与平台账号）：
创建校验套餐存在且真流量额度大于零，阈值为 1%～100% 的两位小数；修改只影响后续扫描，不回填也
不改写既有预警快照；全部写操作记录操作者、前后值与时间。

新增每日 06:00（Asia/Shanghai）扫描任务 package:traffic:alert:scan，与套餐临期扫描共用 data_cleanup
队列：按资产汇总当前有效套餐的真流量，分子取使用记录真已用量、分母取使用记录真总量快照，命中
主套餐规则阈值时在同一事务创建预警与可靠通知事件；重复执行以唯一冲突视为已处理，不重复投递，
不建停机锁、不调用运营商。

新增预警列表、详情与异步导出 GET /api/admin/package-traffic-alerts、GET /api/admin/package-traffic-alerts/:id、
POST /api/admin/package-traffic-alerts/export，列表与详情一律读冻结快照；新增通知类型
package.traffic.alert 与受控目标 package_traffic_alert_detail，目标解析仅对超级管理员与平台账号
返回可跳转，越权与不存在统一按资源不可见处理。

同步 OpenAPI（cmd/gendocs、cmd/api/docs.go、pkg/openapi/handlers.go）、审计动作与资源注册、上下文
健康检查证据；归档变更并同步 package-traffic-alert 主 Spec。

internal/infrastructure/audit/registry.go

@@ -221,6 +221,11 @@ func NewRegistry() *Registry {
 	businessUserGroupDisabled := businessUserGroupAction(constants.AuditActionBusinessUserGroupDisabled, "停用业务用户组", constants.AuditRiskNormal, constants.AuditResourceBusinessUserGroup)
 	businessUserGroupDeleted := businessUserGroupAction(constants.AuditActionBusinessUserGroupDeleted, "删除业务用户组", constants.AuditRiskHigh, constants.AuditResourceBusinessUserGroup)
 	businessUserGroupMembersUpdated := businessUserGroupAction(constants.AuditActionBusinessUserGroupMembersUpdated, "批量维护业务用户组成员", constants.AuditRiskNormal, constants.AuditResourceAccount)
+	packageTrafficAlertRuleCreated := packageTrafficAlertAction(constants.AuditActionPackageTrafficAlertRuleCreated, "创建套餐真流量预警规则", constants.AuditRiskNormal, constants.AuditResourcePackageTrafficAlertRule, constants.AuditActorAccount, constants.AuditSourceAdminAPI)
+	packageTrafficAlertRuleUpdated := packageTrafficAlertAction(constants.AuditActionPackageTrafficAlertRuleUpdated, "更新套餐真流量预警规则", constants.AuditRiskNormal, constants.AuditResourcePackageTrafficAlertRule, constants.AuditActorAccount, constants.AuditSourceAdminAPI)
+	packageTrafficAlertRuleEnabled := packageTrafficAlertAction(constants.AuditActionPackageTrafficAlertRuleEnabled, "启用套餐真流量预警规则", constants.AuditRiskNormal, constants.AuditResourcePackageTrafficAlertRule, constants.AuditActorAccount, constants.AuditSourceAdminAPI)
+	packageTrafficAlertRuleDisabled := packageTrafficAlertAction(constants.AuditActionPackageTrafficAlertRuleDisabled, "停用套餐真流量预警规则", constants.AuditRiskNormal, constants.AuditResourcePackageTrafficAlertRule, constants.AuditActorAccount, constants.AuditSourceAdminAPI)
+	packageTrafficAlertTriggered := packageTrafficAlertAction(constants.AuditActionPackageTrafficAlertTriggered, "创建套餐真流量达量预警", constants.AuditRiskNormal, constants.AuditResourcePackageTrafficAlert, constants.AuditActorSystemTask, constants.AuditSourceWorker)
 	shopBusinessOwnerBatchUpdated := batchRootAction(constants.AuditActionShopBusinessOwnerBatchUpdated, "批量交接店铺负责人", constants.AuditResourceShopBusinessOwnerBatch)
 	shopBusinessOwnerImported := taskAction(constants.AuditActionShopBusinessOwnerImported, "导入变更店铺负责人", constants.AuditResourceShop, constants.AuditActorSystemTask, constants.AuditSourceWorker)
 	shopBusinessOwnerImportTaskCreated := taskAction(constants.AuditActionShopBusinessOwnerImportTaskCreated, "创建店铺负责人导入任务", constants.AuditResourceShopBusinessOwnerImportTask, constants.AuditActorAccount, constants.AuditSourceAdminAPI)
@@ -594,6 +599,11 @@ func NewRegistry() *Registry {
 			constants.AuditActionBusinessUserGroupDisabled:              businessUserGroupDisabled,
 			constants.AuditActionBusinessUserGroupDeleted:               businessUserGroupDeleted,
 			constants.AuditActionBusinessUserGroupMembersUpdated:        businessUserGroupMembersUpdated,
+			constants.AuditActionPackageTrafficAlertRuleCreated:         packageTrafficAlertRuleCreated,
+			constants.AuditActionPackageTrafficAlertRuleUpdated:         packageTrafficAlertRuleUpdated,
+			constants.AuditActionPackageTrafficAlertRuleEnabled:         packageTrafficAlertRuleEnabled,
+			constants.AuditActionPackageTrafficAlertRuleDisabled:        packageTrafficAlertRuleDisabled,
+			constants.AuditActionPackageTrafficAlertTriggered:           packageTrafficAlertTriggered,
 			constants.AuditActionShopBusinessOwnerBatchUpdated:          shopBusinessOwnerBatchUpdated,
 			constants.AuditActionShopBusinessOwnerImported:              shopBusinessOwnerImported,
 			constants.AuditActionShopBusinessOwnerImportTaskCreated:     shopBusinessOwnerImportTaskCreated,
@@ -841,6 +851,14 @@ func NewRegistry() *Registry {
 				Type: constants.AuditResourcePhoneAssetUnbindImportTask, Name: "手机号资产解绑导入任务",
 				IdentityFields: []string{"id", "task_no", "file_name"},
 			},
+			constants.AuditResourcePackageTrafficAlertRule: {
+				Type: constants.AuditResourcePackageTrafficAlertRule, Name: "套餐真流量预警规则",
+				IdentityFields: []string{"id", "package_id", "threshold_percent", "enabled", "remark"},
+			},
+			constants.AuditResourcePackageTrafficAlert: {
+				Type: constants.AuditResourcePackageTrafficAlert, Name: "套餐真流量达量预警",
+				IdentityFields: []string{"id", "package_usage_id", "package_id", "asset_type", "asset_id", "threshold_percent_snapshot", "used_mb_snapshot", "limit_mb_snapshot", "usage_percent_snapshot", "shop_id", "business_owner_account_id"},
+			},
 			constants.AuditResourceNotification: {
 				Type: constants.AuditResourceNotification, Name: "站内通知",
 				IdentityFields: []string{"id", "event_id", "recipient_kind", "recipient_id", "category", "type", "severity", "ref_type", "ref_id", "ref_key"},
@@ -1403,6 +1421,17 @@ func businessUserGroupAction(code, name, risk, primaryResource string) ActionDef
 	}
 }
 
+// packageTrafficAlertAction 定义套餐真流量预警规则维护与达量触发动作。
+// 规则维护由后台 API 写入；达量触发由扫描任务在业务事务内写入，两者通过 actor/source 区分。
+func packageTrafficAlertAction(code, name, risk, primaryResource, actor, source string) ActionDefinition {
+	return ActionDefinition{
+		Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: risk,
+		PrimaryResource: primaryResource, AllowedActor: actor, Source: source, RequireTransaction: true,
+		DefaultVisibility: constants.AuditSubjectInternalOnly,
+		AllowedVisibility: []string{constants.AuditSubjectInternalOnly},
+	}
+}
+
 // batchRootAction 定义同步后台批次根动作；子事件自带店铺或资源作用域。
 func batchRootAction(code, name, primaryResource string) ActionDefinition {
 	return ActionDefinition{