fix(memory): FTS5 full-text search + browser hand autonomy gate

M4-05: Replace LIKE-only search with FTS5-first strategy:
- Add memories_fts virtual table (unicode61 tokenizer)
- FTS5 MATCH primary path with CJK LIKE fallback
- Sync FTS index on store()

M3-03: Add autonomy approval check to browserHandStore:
- executeTemplate: check canAutoExecute before running
- executeScript: check approval gate for JS execution

desktop/src/store/browserHandStore.ts

@@ -26,6 +26,7 @@ import {
   type LogLevel,
   type SessionStatus,
 } from '../components/BrowserHand/templates';
+import { canAutoExecute } from '../lib/autonomy-manager';
 
 // ============================================================================
 // Store State Interface
@@ -220,6 +221,13 @@ export const useBrowserHandStore = create<BrowserHandState & BrowserHandActions>
 
   // Template Execution
   executeTemplate: async (templateId: string, params: Record<string, unknown>) => {
+    // Autonomy approval gate — browser hand requires_approval=true
+    const { canProceed, decision } = canAutoExecute('hand_trigger' as any, 5);
+    if (!canProceed) {
+      set({ error: `Browser 操作需要审批: ${decision.reason || '请确认后重试'}` });
+      throw new Error(`Browser 操作需要审批: ${decision.reason || 'requires approval'}`);
+    }
+
     const store = get();
 
     // Find template
@@ -339,6 +347,13 @@ export const useBrowserHandStore = create<BrowserHandState & BrowserHandActions>
   },
 
   executeScript: async (script: string, args?: unknown[]) => {
+    // Autonomy approval gate — arbitrary JS execution is high risk
+    const { canProceed, decision } = canAutoExecute('hand_trigger' as any, 8);
+    if (!canProceed) {
+      set({ error: `脚本执行需要审批: ${decision.reason || '请确认后重试'}` });
+      throw new Error(`Script execution requires approval: ${decision.reason || 'requires approval'}`);
+    }
+
     const store = get();
 
     if (!store.activeSessionId) {