fix(saas): P2 code quality fixes + config PATCH/PUT alignment

P2 code quality (SEC2-P2-01~10):
- P2-04: Replace vague TODO with detailed Phase 2 design note in generate_embedding.rs
- P2-05: Add NOTE(fire-and-forget) annotations to 4 long-running tokio::spawn in main.rs
- P2-07: Add DESIGN NOTE to scheduler explaining sequential execution rationale
- P2-08: Add compile-time table name whitelist + runtime char validation in db.rs
- P2-02: Verified N/A (only zclaw-pipeline uses serde_yaml_bw, no inconsistency)
- P2-06: Verified N/A (bind loop correctly matches 6-column placeholders)
- P2-03: Remains OPEN (requires upstream sqlx release)

Config HTTP method alignment (B3-4):
- Fix admin-v2 config.ts: request.patch -> request.put to match backend .put() route
- Fix backend handler doc comment: PATCH -> PUT
- Add @reserved annotations to 6 config handlers without frontend callers

crates/zclaw-saas/src/main.rs

@@ -104,6 +104,8 @@ async fn main() -> anyhow::Result<()> {
     zclaw_saas::scheduler::start_user_task_scheduler(db.clone());
 
     // 启动内存中的 rate limit 条目清理
+    // NOTE (fire-and-forget): Long-running background service task. JoinHandle not bound
+    // because this task runs for the lifetime of the process and is cancelled on shutdown.
     let rate_limit_state = state.clone();
     tokio::spawn(async move {
         let mut interval = tokio::time::interval(std::time::Duration::from_secs(300));
@@ -119,6 +121,7 @@ async fn main() -> anyhow::Result<()> {
     {
         let cache_state = state.clone();
         let db_clone = db.clone();
+        // NOTE (fire-and-forget): Long-running cache refresh service. JoinHandle not bound.
         tokio::spawn(async move {
             let mut interval = tokio::time::interval(std::time::Duration::from_secs(60));
             loop {
@@ -136,6 +139,7 @@ async fn main() -> anyhow::Result<()> {
         let flush_state = state.clone();
         let batch_interval = config.database.rate_limit_batch_interval_secs;
         let batch_max = config.database.rate_limit_batch_max_size;
+        // NOTE (fire-and-forget): Long-running rate limit flush service. JoinHandle not bound.
         tokio::spawn(async move {
             let mut interval = tokio::time::interval(std::time::Duration::from_secs(batch_interval));
             loop {
@@ -148,6 +152,7 @@ async fn main() -> anyhow::Result<()> {
     // 连接池可观测性 (30s 指标日志)
     {
         let metrics_db = db.clone();
+        // NOTE (fire-and-forget): Long-running pool metrics service. JoinHandle not bound.
         tokio::spawn(async move {
             let mut interval = tokio::time::interval(std::time::Duration::from_secs(30));
             loop {