feat(saas): add down migrations for all incremental schema changes (AUD3-DB-01)

- 16 down SQL files in migrations/down/ for each incremental migration
- db::run_down_migrations() executes rollback files in reverse order
- migrate_down CLI task: task=migrate_down timestamp=20260402
- Initial schema and seed data excluded (would be destructive)

crates/zclaw-saas/src/db.rs

@@ -123,6 +123,50 @@ async fn run_migration_files(pool: &PgPool, dir: &std::path::Path) -> SaasResult
     Ok(())
 }
 
+/// 从 down/ 目录加载并执行回滚迁移文件（按文件名倒序）
+///
+/// 用法: `task=migrate_down timestamp=20260402000001`
+/// 会回滚 >= 该时间戳的所有增量迁移。不包含初始 schema 和 seed data。
+pub async fn run_down_migrations(pool: &PgPool, target: &str) -> SaasResult<()> {
+    let down_dir = std::path::Path::new("crates/zclaw-saas/migrations/down");
+    let alt_dir = std::path::Path::new("migrations/down");
+    let dir = if down_dir.exists() { down_dir } else if alt_dir.exists() { alt_dir } else {
+        tracing::warn!("No down migrations directory found");
+        return Ok(());
+    };
+
+    let mut entries: Vec<std::path::PathBuf> = std::fs::read_dir(dir)?
+        .filter_map(|e| e.ok())
+        .map(|e| e.path())
+        .filter(|p| {
+            p.extension().map(|ext| ext == "sql").unwrap_or(false)
+            && p.file_name()
+                .map(|n| n.to_string_lossy().starts_with(target))
+                .unwrap_or(false)
+        })
+        .collect();
+    entries.sort_by(|a, b| b.cmp(a)); // Reverse order (newest first)
+
+    if entries.is_empty() {
+        tracing::info!("No down migrations match prefix '{}'", target);
+        return Ok(());
+    }
+
+    for path in &entries {
+        let filename = path.file_name().unwrap_or_default().to_string_lossy();
+        tracing::info!("Running down migration: {}", filename);
+        let content = std::fs::read_to_string(path)?;
+        for stmt in split_sql_statements(&content) {
+            let trimmed = stmt.trim();
+            if !trimmed.is_empty() && !trimmed.starts_with("--") {
+                sqlx::query(trimmed).execute(pool).await?;
+            }
+        }
+    }
+    tracing::info!("Down migrations complete (prefix={})", target);
+    Ok(())
+}
+
 /// 按语句分割 SQL 文件内容，正确处理:
 /// - 单引号字符串 `'...'`
 /// - 双引号标识符 `"..."`

crates/zclaw-saas/src/tasks/mod.rs

@@ -3,7 +3,7 @@
 //! 提供可手动执行的运维命令：
 //! - seed_admin — 创建管理员账号
 //! - cleanup_devices — 清理不活跃设备
-//! - migrate_schema — 手动触发 schema 迁移
+//! - migrate_down — 回滚指定迁移（timestamp=20260402 回滚所有 >= 该前缀的迁移）
 
 use std::collections::HashMap;
 use sqlx::PgPool;
@@ -27,6 +27,7 @@ pub fn builtin_tasks() -> Vec<Box<dyn Task>> {
     vec![
         Box::new(SeedAdminTask),
         Box::new(CleanupDevicesTask),
+        Box::new(MigrateDownTask),
     ]
 }
 
@@ -86,3 +87,18 @@ impl Task for CleanupDevicesTask {
         Ok(())
     }
 }
+
+/// 回滚数据库迁移
+struct MigrateDownTask;
+
+#[async_trait::async_trait]
+impl Task for MigrateDownTask {
+    fn name(&self) -> &str { "migrate_down" }
+    fn description(&self) -> &str { "回滚指定时间戳之后的迁移（timestamp=20260402 回滚 >= 该前缀的所有增量迁移）" }
+
+    async fn run(&self, db: &PgPool, args: &HashMap<String, String>) -> SaasResult<()> {
+        let timestamp = args.get("timestamp")
+            .ok_or_else(|| crate::error::SaasError::InvalidInput("Missing 'timestamp' argument (e.g. 20260402)".into()))?;
+        crate::db::run_down_migrations(db, timestamp).await
+    }
+}