fix(security): F01 授权门禁不可被配置关闭 + F02 业务坐标按可信来源隔离（含唯一键 SQL）

src/main/java/com/yunhai/flowcenter/entity/FlwInstance.java

@@ -16,7 +16,7 @@ import java.time.LocalDateTime;
  * 办件实例（概览 §4.3 + V2.0 Part D）：托管模式下业务对象留在业务方，本表只存
  * biz_title/biz_url/biz_snapshot 快照与关联键。正式命令每轮独立实例，唯一域为
  * (school, sourcePrincipalId, bizType, bizId, applyRound)，单在途由坐标表事务指针保护。
- * sourcePrincipalId=NULL / legacySlot=1 仅保留迁移前旧入口的一业务一行语义；正式模式关闭旧写入口。
+ * 旧入口以 sourcePrincipalId + legacySlot=1 实现每来源一业务一行；正式命令 legacySlot=NULL。
  *
  * <p>version 是乐观锁（推进串行化）兼回调 payload 的 instanceVersion（业务方按它丢弃乱序旧事件），
  * 由 JPA @Version 在 flush 时自增。
@@ -26,7 +26,7 @@ import java.time.LocalDateTime;
 @Entity
 @Table(name = "flw_instance",
         uniqueConstraints = {
-                @UniqueConstraint(name = "uk_flw_instance_legacy", columnNames = {"sch_id", "biz_type", "biz_id", "legacy_slot"}),
+                @UniqueConstraint(name = "uk_flw_instance_legacy", columnNames = {"sch_id", "source_principal_id", "biz_type", "biz_id", "legacy_slot"}),
                 @UniqueConstraint(name = "uk_flw_instance_round", columnNames = {"sch_id", "source_principal_id", "biz_type", "biz_id", "apply_round"})},
         indexes = {
                 @Index(name = "idx_flw_inst_submitter", columnList = "sch_id, submitter_id, status"),
@@ -34,7 +34,7 @@ import java.time.LocalDateTime;
 public class FlwInstance extends BaseEntity {
     @Column(name="source_principal_id",length=36,updatable=false)
     private String sourcePrincipalId;
-    /** 1 for legacy writers, NULL for formal commands. Migration must drop the old three-column UK. */
+    /** 1 for source-scoped legacy API writers, NULL for formal commands. */
     @Column(name="legacy_slot")
     private Integer legacySlot = 1;