feat(saas): SQL 迁移系统 + TIMESTAMPTZ + 热路径重构

P0: SQL 迁移系统
- crates/zclaw-saas/migrations/ — 独立 SQL 迁移文件目录
- 20260329000001_initial_schema.sql — TIMESTAMPTZ 完整 schema
- 20260329000002_seed_data.sql — 角色种子数据
- db.rs: 移除 335 行内联 SCHEMA_SQL，改为文件加载
- 版本追踪: saas_schema_version 表管理迁移状态
- 向后兼容: 已有 TEXT 时间戳数据库不受影响

P1: 安全重构
- relay/service.rs: update_task_status 从 format!() 改为 3 条独立参数化查询
- config.rs: 移除 TODO 注释，补充字段文档说明
- state.rs: 添加 dispatch_log_operation 异步日志派发方法

P2: Worker 集成
- state.rs: WorkerDispatcher 接入 AppState
- 所有异步后台任务基础设施就绪

crates/zclaw-saas/src/relay/service.rs

@@ -113,24 +113,30 @@ pub async fn update_task_status(
 ) -> SaasResult<()> {
     let now = chrono::Utc::now().to_rfc3339();
 
-    let update_sql = match status {
-        "processing" => "started_at = $1, status = 'processing', attempt_count = attempt_count + 1",
-        "completed" => "completed_at = $1, status = 'completed', input_tokens = COALESCE($2, input_tokens), output_tokens = COALESCE($3, output_tokens)",
-        "failed" => "completed_at = $1, status = 'failed', error_message = $2",
+    match status {
+        "processing" => {
+            sqlx::query(
+                "UPDATE relay_tasks SET started_at = $1, status = 'processing', attempt_count = attempt_count + 1 WHERE id = $2"
+            )
+            .bind(&now).bind(task_id)
+            .execute(db).await?;
+        }
+        "completed" => {
+            sqlx::query(
+                "UPDATE relay_tasks SET completed_at = $1, status = 'completed', input_tokens = COALESCE($2, input_tokens), output_tokens = COALESCE($3, output_tokens) WHERE id = $4"
+            )
+            .bind(&now).bind(input_tokens).bind(output_tokens).bind(task_id)
+            .execute(db).await?;
+        }
+        "failed" => {
+            sqlx::query(
+                "UPDATE relay_tasks SET completed_at = $1, status = 'failed', error_message = $2 WHERE id = $3"
+            )
+            .bind(&now).bind(error_message).bind(task_id)
+            .execute(db).await?;
+        }
         _ => return Err(SaasError::InvalidInput(format!("无效任务状态: {}", status))),
-    };
-
-    let sql = format!("UPDATE relay_tasks SET {} WHERE id = $4", update_sql);
-
-    let mut query = sqlx::query(&sql).bind(&now);
-    if status == "completed" {
-        query = query.bind(input_tokens).bind(output_tokens);
     }
-    if status == "failed" {
-        query = query.bind(error_message);
-    }
-    query = query.bind(task_id);
-    query.execute(db).await?;
 
     Ok(())
 }