feat(maintenance): add policy executor and config provider

ConfigProvider, PolicyExecutor, DBStatsProvider, scheduler и safety; зависимость robfig/cron/v3.

Co-authored-by: Cursor <[email protected]>

internal/maintenance/safety_test.go

@@ -0,0 +1,46 @@
+package maintenance
+
+import "testing"
+
+func TestValidateCondition(t *testing.T) {
+	tests := []struct {
+		cond string
+		ok   bool
+	}{
+		{"true", true},
+		{"status IN ('succeeded', 'failed')", true},
+		{"1=1; DROP TABLE tenant", false},
+		{"x -- comment", false},
+	}
+	for _, tc := range tests {
+		err := ValidateCondition(tc.cond)
+		if tc.ok && err != nil {
+			t.Fatalf("cond %q: want ok, got %v", tc.cond, err)
+		}
+		if !tc.ok && err == nil {
+			t.Fatalf("cond %q: want error", tc.cond)
+		}
+	}
+}
+
+func TestValidateTableName(t *testing.T) {
+	if err := ValidateTableName("job_audit"); err != nil {
+		t.Fatal(err)
+	}
+	if err := ValidateTableName("tenant"); err == nil {
+		t.Fatal("expected blocked table")
+	}
+	if err := ValidateTableName("bad-name"); err == nil {
+		t.Fatal("expected invalid ident")
+	}
+}
+
+func TestNormalizeBatchLimit(t *testing.T) {
+	if got := NormalizeBatchLimit(nil); got != DefaultBatchRows {
+		t.Fatalf("default=%d got=%d", DefaultBatchRows, got)
+	}
+	max := 200000
+	if got := NormalizeBatchLimit(&max); got != MaxBatchRows {
+		t.Fatalf("max=%d got=%d", MaxBatchRows, got)
+	}
+}