feat(intercept): 新增内置拦截规则「删除类接口路径」

内置的 HTTP 破坏性规则只认 DELETE 方法（curl -X DELETE、requests.delete(、
method:'DELETE'），路径类规则的词表又只有 /clear /wipe /flush /purge /truncate
/drop /destroy /factory-reset /reset-all。而多数应用的删除接口用 GET/POST 就能
触发，于是 `curl 'http://t/api/user/delete?id=1'` 不命中任何内置规则，会真实删掉
目标数据。

补一条 deny 规则覆盖 /delete /del /remove /unlink /erase /destroy，允许
/deleteAll、/delete_user、/delete-user 这类后缀形式（destroy 是重复覆盖：v1 那条
不允许后缀，/destroyAll 是漏的）。动词后强制跟分隔符，/delivery、/details、
/delta、/delegate 不会被误拦。

种子走独立标记位 intercept_default_rules_v3，已有实例升级后也会拿到——改 v1 的
字面量对老库无效（标记位已是 done）。插入带 WHERE NOT EXISTS 兜底，标记位丢失也
不会插重复。正则提为包级常量，配纯正则单测（不依赖 DB）覆盖命中与误伤两侧。

db/db.go

@@ -261,6 +261,9 @@ ON CONFLICT (name) DO NOTHING`,
 	if err := d.seedDefaultInterceptRulesV2(); err != nil {
 		return fmt.Errorf("seed intercept rules v2: %w", err)
 	}
+	if err := d.seedDefaultInterceptRulesV3(); err != nil {
+		return fmt.Errorf("seed intercept rules v3: %w", err)
+	}
 	if err := d.seedDefaultAssetInterceptRules(); err != nil {
 		return fmt.Errorf("seed asset intercept rules: %w", err)
 	}
@@ -563,3 +566,37 @@ ON CONFLICT DO NOTHING`,
 	}
 	return d.SetSetting("intercept_default_rules_v2", "done")
 }
+
+// seedDefaultInterceptRulesV3 adds the delete-endpoint path rule. The v1 HTTP rules
+// only catch the DELETE *method* (curl -X DELETE, requests.delete(, method:'DELETE'),
+// and v1's path rule covers only /clear /wipe /flush /purge /truncate /drop /destroy
+// /factory-reset /reset-all — so a plain `curl 'http://t/api/user/delete?id=1'` (a
+// delete endpoint reached with GET/POST, which is how most web apps expose deletion)
+// slipped through every built-in rule. Own flag so it also lands on DBs that already
+// ran v1/v2, where editing the v1 seed would have no effect.
+//
+// The pattern deliberately requires a separator after the verb so /delivery,
+// /details, /delta and /delegate do not match, while /deleteAll, /delete_user and
+// /delete-user do. destroy is re-covered here because v1's rule does not allow a
+// suffix (/destroyAll was missed).
+//
+// Exported as a package const only so the seeded regex is unit-testable without a DB.
+const deleteEndpointPathPattern = `(?i)/(?:(?:delete|remove|unlink|erase|destroy)[-\w]*|del)(?:[/?#"'\s]|$)`
+
+func (d *DB) seedDefaultInterceptRulesV3() error {
+	if v, _, _ := d.GetSetting("intercept_default_rules_v3"); v == "done" {
+		return nil
+	}
+	const name = "[内置] 删除类接口路径"
+	if _, err := d.Exec(`
+INSERT INTO intercept_rules(name, enabled, priority, match_target, match_type, pattern, action, message, timeout_enabled, timeout_seconds, timeout_action)
+SELECT $1, true, 80, 'tool_input', 'regex', $2, 'deny', $3, false, 60, 'deny'
+WHERE NOT EXISTS (SELECT 1 FROM intercept_rules WHERE name = $1)`,
+		name,
+		deleteEndpointPathPattern,
+		"禁止调用删除类接口（/delete /remove /unlink /erase 等），不论使用哪种 HTTP 方法——多数应用的删除接口用 GET/POST 就能触发，同样会真实删除目标数据",
+	); err != nil {
+		return fmt.Errorf("rule %q: %w", name, err)
+	}
+	return d.SetSetting("intercept_default_rules_v3", "done")
+}