feat: 新增资产拦截规则（全局黑名单）增删改查

新增独立于命令拦截(intercept_rules)的资产拦截功能，仅提供规则的
存储与管理；具体匹配/拦截逻辑另行实现。

- db: 新增 asset_intercept_rules 表(schema.sql，幂等)与 CRUD 层
  (db/asset_intercept.go)；kind 支持全等/模糊的 域名·IP·URL 及 CIDR
- db: 首启动 seed 内置模糊拦截政府(.gov/.gov.cn)与教育(.edu/.edu.cn)
  网站，settings 标记位门控，可禁用/删除且重启不复活
- server: /api/asset-intercept/rules 的 list/create/update/delete/toggle；
  cidr、exact_ip 做格式校验
- web: 新增「资产拦截」页(/system/intercept/assets)与侧边栏入口、
  api 与类型定义

web/src/lib/api.ts

@@ -14,6 +14,7 @@ import type {
   AgentTrigger,
   ArchiveBatchItem,
   Asset,
+  AssetInterceptRule,
   Audit,
   BatchCategoryItem,
   BatchControlItem,
@@ -1099,6 +1100,16 @@ export const api = {
   toggleInterceptRule: (id: number, enabled: boolean) =>
     post<{ ok: boolean; enabled: boolean }>(`/intercept/rules/${id}/toggle`, { enabled }),
 
+  // ---- asset intercept rules（资产拦截：全局黑名单） ----
+  assetInterceptRules: () => get<{ rules: AssetInterceptRule[] }>("/asset-intercept/rules").then((r) => arr(r.rules)),
+  createAssetInterceptRule: (rule: Pick<AssetInterceptRule, "enabled" | "kind" | "pattern" | "note">) =>
+    post<AssetInterceptRule>("/asset-intercept/rules", rule),
+  updateAssetInterceptRule: (id: number, rule: Pick<AssetInterceptRule, "enabled" | "kind" | "pattern" | "note">) =>
+    put<AssetInterceptRule>(`/asset-intercept/rules/${id}`, rule),
+  deleteAssetInterceptRule: (id: number) => del<{ deleted: number }>(`/asset-intercept/rules/${id}`),
+  toggleAssetInterceptRule: (id: number, enabled: boolean) =>
+    post<{ ok: boolean; enabled: boolean }>(`/asset-intercept/rules/${id}/toggle`, { enabled }),
+
   // ---- intercept pending (ask) ----
   interceptPending: () => get<{ pending: InterceptPending[] }>("/intercept/pending").then((r) => arr(r.pending)),
   interceptGetOne: (id: number) => get<InterceptPending>(`/intercept/pending/${id}`),

web/src/lib/types.ts

@@ -1191,6 +1191,27 @@ export interface InterceptRule {
   updated_at: string;
 }
 
+// ---- Asset Intercept Rules（资产拦截：全局黑名单） ----
+export type AssetInterceptKind =
+  | "exact_domain"
+  | "exact_ip"
+  | "exact_url"
+  | "fuzzy_domain"
+  | "fuzzy_ip"
+  | "fuzzy_url"
+  | "cidr";
+
+export interface AssetInterceptRule {
+  id: number;
+  enabled: boolean;
+  kind: AssetInterceptKind;
+  pattern: string;
+  note: string;
+  builtin: boolean;
+  created_at: string;
+  updated_at: string;
+}
+
 export interface InterceptPending {
   decision_source?: "rule" | "model" | "unknown" | "";
   id: number;