fix(脚本): 收紧 T+ 运维脚本校验与恢复行为

login 脚本原先在结尾无条件 SET READ_ONLY：库名误指向其他
可写库时会把它锁成只读。改为开头校验库存在（不存在即中止）
并记录初始 Updateability，结尾仅当初始为 READ_ONLY 时恢复。
inventory 脚本的库名校验统一为 restore 脚本的字符白名单。

Co-Authored-By: Claude Code <noreply@anthropic.com>

scripts/tplus/create_tplus_readonly_login.ps1

@@ -30,7 +30,14 @@ $safeDatabaseLiteral = $DatabaseName.Replace("'", "''")
 $safeLoginIdentifier = $LoginName.Replace("]", "]]" )
 $safeReaderPassword = $readerPasswordText.Replace("'", "''")
 $sql = @"
-IF DATABASEPROPERTYEX(N'$safeDatabaseLiteral', 'Updateability') = N'READ_ONLY'
+IF DB_ID(N'$safeDatabaseLiteral') IS NULL
+BEGIN
+    ;THROW 51000, N'目标数据库不存在，已停止配置，未修改任何库。', 1;
+END;
+DECLARE @initialReadonly bit =
+    CASE WHEN CAST(DATABASEPROPERTYEX(N'$safeDatabaseLiteral', 'Updateability') AS nvarchar(30)) = N'READ_ONLY'
+         THEN 1 ELSE 0 END;
+IF @initialReadonly = 1
     ALTER DATABASE [$safeDatabaseIdentifier] SET READ_WRITE;
 IF NOT EXISTS (SELECT 1 FROM sys.server_principals WHERE name = N'$safeLoginIdentifier')
 BEGIN
@@ -49,8 +56,9 @@ IF NOT EXISTS (
 )
     EXEC sp_addrolemember N'db_datareader', N'$safeLoginIdentifier';
 DENY INSERT, UPDATE, DELETE TO [$safeLoginIdentifier];
-ALTER DATABASE [$safeDatabaseIdentifier] SET READ_ONLY;
+IF @initialReadonly = 1
+    ALTER DATABASE [$safeDatabaseIdentifier] SET READ_ONLY;
 "@
 
 Invoke-TPlusContainerSql -ContainerName $ContainerName -Sql $sql -SaPassword $SaPassword
-Write-Host "只读账号已配置：$LoginName（未输出密码）"
+Write-Host "只读账号已配置：$LoginName（未输出密码）。仅当目标库初始为 READ_ONLY 时才恢复只读；初始为可写的库保持可写。"

scripts/tplus/inventory_tplus_database.ps1

@@ -13,6 +13,10 @@ $ErrorActionPreference = "Stop"
 
 . (Join-Path $PSScriptRoot "container_sql.ps1")
 
+if ($DatabaseName -notmatch '^[A-Za-z_][A-Za-z0-9_]{0,127}$') {
+    throw "核验数据库名只能使用字母、数字和下划线。"
+}
+
 New-Item -ItemType Directory -Path $ReportRoot -Force | Out-Null
 $reportPath = Join-Path $ReportRoot ("Tplus-核验-{0:yyyyMMdd-HHmmss}.md" -f (Get-Date))
 $safeDatabaseIdentifier = $DatabaseName.Replace("]", "]]" )