feat: split worker login device limits by type

apps/backend/scripts/check-sql-guard.ts

@@ -4,6 +4,7 @@
  */
 import fs from 'node:fs'
 import path from 'node:path'
+import { execFileSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 
 const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url))
@@ -57,6 +58,31 @@ const checks: Array<{ name: string; file: string; patterns: string[] }> = [
 ]
 
 const failures: string[] = []
+
+// 已应用的历史迁移必须保持字节不变，所有结构或数据修复都必须新增迁移文件。
+try {
+  const diffOutputs = [
+    execFileSync('git', ['diff', '--name-status', 'HEAD', '--', 'src/db/migrations'], {
+      cwd: BACKEND_ROOT,
+      encoding: 'utf8',
+    }),
+    execFileSync('git', ['diff', '--name-status', 'HEAD^', 'HEAD', '--', 'src/db/migrations'], {
+      cwd: BACKEND_ROOT,
+      encoding: 'utf8',
+    }),
+  ]
+  const changedHistoricalMigrations = diffOutputs
+    .flatMap((output) => output.split('\n'))
+    .map((line) => line.trim().split(/\s+/))
+    .filter(([status, file]) => status && file?.endsWith('.sql') && status !== 'A')
+    .map(([status, file]) => `${status} ${file}`)
+  if (changedHistoricalMigrations.length > 0) {
+    failures.push(`历史迁移文件不可修改: ${changedHistoricalMigrations.join(', ')}`)
+  }
+} catch (error) {
+  failures.push(`历史迁移完整性检查失败: ${error instanceof Error ? error.message : String(error)}`)
+}
+
 for (const check of checks) {
   if (!fs.existsSync(check.file)) {
     failures.push(`${check.name}: 文件不存在 ${check.file}`)