✨ feat(connection): 支持生产连接多项保护策略

- 新增数据编辑、结构编辑、脚本执行和数据导入四类连接级保护配置
- 升级生产连接保护弹窗为多选卡片，并修复选项对齐与勾选态显示
- 按保护类型收口 QueryEditor、DataGrid、表设计、导入与同步目标入口
- 后端统一拦截 SQL 或 Mongo 写操作、结果编辑、结构变更和导入写入
- AI 本地工具与 RPC 执行链路透传连接保护配置并复用后端守卫
- 补充多语言文案、定向测试与需求追踪记录

frontend/src/utils/connectionRpcConfig.ts

@@ -1,4 +1,8 @@
 import { connection } from '../../wailsjs/go/models';
+import {
+  deriveLegacyConnectionReadOnlyFlag,
+  normalizeConnectionProtectionConfig,
+} from './connectionReadOnly';
 import {
   OCEANBASE_PROTOCOL_PARAM_KEYS,
   resolveOceanBaseProtocolFromConfig,
@@ -120,6 +124,7 @@ export function buildRpcConnectionConfig(
   const baseId = toStringValue(config.id).trim() || toStringValue(overrides.id).trim() || undefined;
   const timeout = toOptionalInteger(rpcMerged.timeout, toOptionalInteger(config.timeout));
   const redisDB = toOptionalInteger(rpcMerged.redisDB, toOptionalInteger(config.redisDB));
+  const protection = normalizeConnectionProtectionConfig(rpcMerged.protection);
 
   const rpcConfig = new connection.ConnectionConfig({
     ...rpcPayload,
@@ -129,7 +134,8 @@ export function buildRpcConnectionConfig(
     user: toStringValue(rpcMerged.user),
     password: toStringValue(rpcMerged.password),
     database: toStringValue(rpcMerged.database),
-    readOnly: rpcMerged.readOnly === true,
+    readOnly: deriveLegacyConnectionReadOnlyFlag(protection),
+    protection: new connection.ConnectionProtectionConfig(protection),
     useSSH: rpcMerged.useSSH === true,
     ssh: normalizeSSHConfig(rpcMerged.ssh),
     useProxy: rpcMerged.useProxy === true,