fix(security): F01 授权门禁不可被配置关闭 + F02 业务坐标按可信来源隔离（含唯一键 SQL）

src/test/java/com/yunhai/flowcenter/service/FlUsageGrantTest.java

@@ -70,11 +70,11 @@ class FlUsageGrantTest {
     // ==================== Guard：新发起资格 ====================
 
     @Test
-    @DisplayName("enforce 关闭：直通且不出站（灰度期存量行为不变）")
-    void enforceOffPassesThrough() {
+    @DisplayName("enforce 关闭仍不得绕过授权")
+    void enforceOffCannotBypassAuthorization() {
         ReflectionTestUtils.setField(activationClient, "enforce", false);
 
-        assertThat(guard.requireNewApplyGrant(SCH, FLOW, APP_KEY)).isNull();
+        assertThatThrownBy(() -> guard.requireNewApplyGrant(SCH, FLOW, APP_KEY)).isInstanceOf(BizException.class);
         verify(grantRepository, never()).findBySchIdAndFlowGuidAndAppId(anyLong(), anyString(), anyInt());
     }
 
@@ -195,6 +195,7 @@ class FlUsageGrantTest {
         when(appClient.getAppByKey(APP_KEY)).thenReturn(registration(5001));
         when(grantRepository.findBySchIdAndFlowGuidAndAppId(SCH, FLOW, 5001)).thenReturn(Optional.empty());
         when(grantRepository.save(any())).thenAnswer(c -> c.getArgument(0));
+        stubActivation(5001, true);
 
         FlwUsageGrant saved = admin.grant(SCH, FLOW, APP_KEY, "首次授权", "admin");
 
@@ -224,6 +225,7 @@ class FlUsageGrantTest {
     private JsonNode registration(int appId) {
         Map<String, Object> row = new HashMap<>();
         row.put("id", appId);
+        row.put("sourcePrincipalId", "11111111-1111-1111-1111-111111111111");
         row.put("appKey", APP_KEY);
         row.put("appName", "测试应用");
         return mapper.valueToTree(row);
@@ -246,6 +248,7 @@ class FlUsageGrantTest {
         g.setAppId(appId);
         g.setAppKeySnapshot(APP_KEY);
         g.setEnabled(enabled);
+        g.setSourcePrincipalId("11111111-1111-1111-1111-111111111111");
         return g;
     }