feat(gateway): 护栏拦截事件落库 + 安全事件流（T4.B）

- store.GuardrailEvent 表(sundynix_guardrail_event) + AppendGuardrailEvent/ListGuardrailEvents
- middleware.Guardrail(db)：命中 blocked/suspect 时 best-effort 落库
  (actor/kind/reason/signals/method/path/ip，独立超时 ctx)
- GET /api/v1/admin/guardrail-events：安全事件流(倒序，翻页)
- store.clampPage 抽出分页归一(audit/guardrail 共用)
- live：注入 "ignore all previous instructions" → 422 硬拦 + 事件留痕(kind=blocked)
- DEPTH_ROADMAP T4.B 护栏事件打勾

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sundynix-gateway/internal/store/audit.go

@@ -15,13 +15,38 @@ func (p *Postgres) ListAudit(ctx context.Context, limit, offset int) ([]AuditLog
 	if p.db == nil {
 		return nil, errStoreDisabled
 	}
+	limit, offset = clampPage(limit, offset)
+	var out []AuditLog
+	err := p.db.WithContext(ctx).Order("created_at desc").Limit(limit).Offset(offset).Find(&out).Error
+	return out, err
+}
+
+// AppendGuardrailEvent 追加一条护栏命中（best-effort）。
+func (p *Postgres) AppendGuardrailEvent(ctx context.Context, e *GuardrailEvent) error {
+	if p.db == nil || e == nil {
+		return errStoreDisabled
+	}
+	return p.db.WithContext(ctx).Create(e).Error
+}
+
+// ListGuardrailEvents 倒序列出护栏事件（管理端安全事件流）。
+func (p *Postgres) ListGuardrailEvents(ctx context.Context, limit, offset int) ([]GuardrailEvent, error) {
+	if p.db == nil {
+		return nil, errStoreDisabled
+	}
+	limit, offset = clampPage(limit, offset)
+	var out []GuardrailEvent
+	err := p.db.WithContext(ctx).Order("created_at desc").Limit(limit).Offset(offset).Find(&out).Error
+	return out, err
+}
+
+// clampPage 归一分页参数：limit ∈ [1,200]（默认 50），offset ≥ 0。
+func clampPage(limit, offset int) (int, int) {
 	if limit <= 0 || limit > 200 {
 		limit = 50
 	}
 	if offset < 0 {
 		offset = 0
 	}
-	var out []AuditLog
-	err := p.db.WithContext(ctx).Order("created_at desc").Limit(limit).Offset(offset).Find(&out).Error
-	return out, err
+	return limit, offset
 }