fix(T+): 补齐指导成本与读取服务保护

补充业务详情指导成本入口、来源版本和历史封存保护，接入月份锁并完善权限复核。
同步接入读取服务运行状态到页面，补充前端控制、回归测试和服务端只读连接授权校验。

定向隔离测试：89 项通过，1 条既有 Starlette 弃用警告。

backend/tests/unit/test_tplus_connection_file.py

@@ -72,11 +72,37 @@ def test_连接文件不接受sa或应用配置覆盖(tmp_path):
         resolve_tplus_settings(settings)
 
 
+def test_生产连接文件允许显式授权的管理员账号(tmp_path):
+    path = tmp_path / "reader.json"
+    path.write_text(
+        json.dumps({
+            "host": "127.0.0.1", "port": 1433, "database": "test_source",
+            "user": "sa", "password": "test-only-value", "driver": "test_driver",
+        }),
+        encoding="utf-8",
+    )
+    settings = Settings(
+        _env_file=None,
+        app_secret_key="x" * 32,
+        app_env="prod",
+        t_plus_enabled=True,
+        t_plus_allow_admin_account=True,
+        t_plus_connection_file=str(path),
+    )
+    assert resolve_tplus_settings(settings).t_plus_user == "sa"
+
+
 @pytest.mark.parametrize(
-    ("environment", "allowed", "accepted"),
-    [("dev", False, False), ("prod", True, False), ("dev", True, True)],
+    ("environment", "allowed", "admin_allowed", "accepted"),
+    [
+        ("dev", False, False, False),
+        ("prod", True, False, False),
+        ("dev", True, False, True),
+        ("prod", False, True, True),
+        ("prod", False, False, False),
+    ],
 )
-def test_sa仅允许显式启用的开发环境(environment, allowed, accepted):
+def test_sa仅允许显式授权(environment, allowed, admin_allowed, accepted):
     settings = Settings(
         _env_file=None,
         app_secret_key="x" * 32,
@@ -86,9 +112,10 @@ def test_sa仅允许显式启用的开发环境(environment, allowed, accepted):
         t_plus_database="test_source",
         t_plus_odbc_driver="test_driver",
         t_plus_allow_dev_sa=allowed,
+        t_plus_allow_admin_account=admin_allowed,
     )
     if accepted:
         assert resolve_tplus_settings(settings).t_plus_user == "sa"
     else:
-        with pytest.raises(RuntimeError, match="不能使用 sa"):
+        with pytest.raises(RuntimeError, match="管理员账号未获授权"):
             resolve_tplus_settings(settings)