feat(intercept): 新增内置拦截规则「删除类接口路径」

内置的 HTTP 破坏性规则只认 DELETE 方法（curl -X DELETE、requests.delete(、
method:'DELETE'），路径类规则的词表又只有 /clear /wipe /flush /purge /truncate
/drop /destroy /factory-reset /reset-all。而多数应用的删除接口用 GET/POST 就能
触发，于是 `curl 'http://t/api/user/delete?id=1'` 不命中任何内置规则，会真实删掉
目标数据。

补一条 deny 规则覆盖 /delete /del /remove /unlink /erase /destroy，允许
/deleteAll、/delete_user、/delete-user 这类后缀形式（destroy 是重复覆盖：v1 那条
不允许后缀，/destroyAll 是漏的）。动词后强制跟分隔符，/delivery、/details、
/delta、/delegate 不会被误拦。

种子走独立标记位 intercept_default_rules_v3，已有实例升级后也会拿到——改 v1 的
字面量对老库无效（标记位已是 done）。插入带 WHERE NOT EXISTS 兜底，标记位丢失也
不会插重复。正则提为包级常量，配纯正则单测（不依赖 DB）覆盖命中与误伤两侧。

CHANGELOG.md

@@ -4,7 +4,11 @@
 
 ## [Unreleased]
 
-### 流量
+### 拦截
+
+#### 新增的功能
+
+- **新增内置拦截规则「删除类接口路径」**：此前内置的 HTTP 破坏性规则只认 DELETE **方法**（`curl -X DELETE`、`requests.delete(`、`method:'DELETE'`），路径类规则的词表又只有 `/clear /wipe /flush /purge /truncate /drop /destroy /factory-reset /reset-all`——而多数应用的删除接口用 GET/POST 就能触发，于是 `curl 'http://t/api/user/delete?id=1'` 这类调用不命中任何内置规则，会真实删掉目标数据。现补一条 `deny` 规则覆盖 `/delete /del /remove /unlink /erase /destroy`（允许 `/deleteAll`、`/delete_user`、`/delete-user` 这类后缀形式），动词后必须跟分隔符，`/delivery`、`/details`、`/delta`、`/delegate` 不会被误拦。规则走独立的种子标记位，**已有实例升级后也会拿到**；和其余内置规则一样可在「系统 → 命令拦截」里停用或删除。
 
 #### 新增的功能
 

db/db.go

@@ -261,6 +261,9 @@ ON CONFLICT (name) DO NOTHING`,
 	if err := d.seedDefaultInterceptRulesV2(); err != nil {
 		return fmt.Errorf("seed intercept rules v2: %w", err)
 	}
+	if err := d.seedDefaultInterceptRulesV3(); err != nil {
+		return fmt.Errorf("seed intercept rules v3: %w", err)
+	}
 	if err := d.seedDefaultAssetInterceptRules(); err != nil {
 		return fmt.Errorf("seed asset intercept rules: %w", err)
 	}
@@ -563,3 +566,37 @@ ON CONFLICT DO NOTHING`,
 	}
 	return d.SetSetting("intercept_default_rules_v2", "done")
 }
+
+// seedDefaultInterceptRulesV3 adds the delete-endpoint path rule. The v1 HTTP rules
+// only catch the DELETE *method* (curl -X DELETE, requests.delete(, method:'DELETE'),
+// and v1's path rule covers only /clear /wipe /flush /purge /truncate /drop /destroy
+// /factory-reset /reset-all — so a plain `curl 'http://t/api/user/delete?id=1'` (a
+// delete endpoint reached with GET/POST, which is how most web apps expose deletion)
+// slipped through every built-in rule. Own flag so it also lands on DBs that already
+// ran v1/v2, where editing the v1 seed would have no effect.
+//
+// The pattern deliberately requires a separator after the verb so /delivery,
+// /details, /delta and /delegate do not match, while /deleteAll, /delete_user and
+// /delete-user do. destroy is re-covered here because v1's rule does not allow a
+// suffix (/destroyAll was missed).
+//
+// Exported as a package const only so the seeded regex is unit-testable without a DB.
+const deleteEndpointPathPattern = `(?i)/(?:(?:delete|remove|unlink|erase|destroy)[-\w]*|del)(?:[/?#"'\s]|$)`
+
+func (d *DB) seedDefaultInterceptRulesV3() error {
+	if v, _, _ := d.GetSetting("intercept_default_rules_v3"); v == "done" {
+		return nil
+	}
+	const name = "[内置] 删除类接口路径"
+	if _, err := d.Exec(`
+INSERT INTO intercept_rules(name, enabled, priority, match_target, match_type, pattern, action, message, timeout_enabled, timeout_seconds, timeout_action)
+SELECT $1, true, 80, 'tool_input', 'regex', $2, 'deny', $3, false, 60, 'deny'
+WHERE NOT EXISTS (SELECT 1 FROM intercept_rules WHERE name = $1)`,
+		name,
+		deleteEndpointPathPattern,
+		"禁止调用删除类接口（/delete /remove /unlink /erase 等），不论使用哪种 HTTP 方法——多数应用的删除接口用 GET/POST 就能触发，同样会真实删除目标数据",
+	); err != nil {
+		return fmt.Errorf("rule %q: %w", name, err)
+	}
+	return d.SetSetting("intercept_default_rules_v3", "done")
+}

db/intercept_seed_test.go

@@ -0,0 +1,46 @@
+package db
+
+import (
+	"regexp"
+	"testing"
+)
+
+// 内置「删除类接口路径」规则匹配的是整个 tool_input JSON 串，因此用例直接以
+// JSON 形态给出，与 Interceptor 实际拿到的 subject 一致。
+func TestDeleteEndpointPathPattern(t *testing.T) {
+	re := regexp.MustCompile(deleteEndpointPathPattern)
+
+	hit := []string{
+		`{"command":"curl -s 'http://t.com/api/user/delete?id=1'"}`,    // GET 打删除接口
+		`{"command":"curl -X POST http://t.com/admin/delete -d id=1"}`, // POST 打删除接口
+		`{"command":"curl 'http://t.com/api/deleteAll'"}`,
+		`{"command":"curl 'http://t.com/api/delete_user?id=1'"}`,
+		`{"command":"curl 'http://t.com/api/delete-user?id=1'"}`,
+		`{"url":"http://t.com/api/remove?id=1"}`,
+		`{"command":"curl http://t.com/files/unlink/3"}`,
+		`{"command":"curl http://t.com/api/del?id=2"}`,
+		`{"command":"curl -X POST http://t/v1/erase"}`,
+		`{"command":"curl http://t/admin/destroyAll"}`, // v1 的路径规则不允许后缀，这里补上
+	}
+	for _, s := range hit {
+		if !re.MatchString(s) {
+			t.Errorf("应命中却放行: %s", s)
+		}
+	}
+
+	// 动词后必须跟分隔符，避免 /delivery、/details 这类只读路径被误拦。
+	miss := []string{
+		`{"command":"curl 'http://t.com/api/delivery?id=1'"}`,
+		`{"command":"curl 'http://t.com/order/details'"}`,
+		`{"command":"curl 'http://t.com/api/delta/sync'"}`,
+		`{"command":"curl 'http://t.com/user/delegate'"}`,
+		`{"command":"curl 'http://delete.example.com/'"}`, // 删除动词出现在域名而非路径
+		`{"command":"curl 'http://t.com/remote/status'"}`,
+		`{"command":"nmap -p80 10.0.0.1"}`,
+	}
+	for _, s := range miss {
+		if re.MatchString(s) {
+			t.Errorf("误拦: %s", s)
+		}
+	}
+}