fix(db): make KingbaseES driver opt-in and restore default SSRF guard

The KingbaseES JDBC driver is not on Maven Central; declaring it as a
required runtime dependency broke the default build for anyone without
the proprietary jar. Move it into an opt-in `kingbase` Maven profile
(build with `mvn package -Pkingbase`). No Java code imports the driver
classes — it is loaded at runtime via driver-class-name only, so the
default build no longer needs it.

Also drop `mateclaw.browser.ssrf-check-enabled: false` from the default
application.yml: the code default is true, and disabling the SSRF guard
globally is unrelated to KingbaseES support.

mateclaw-server/pom.xml

@@ -349,27 +349,18 @@
             <scope>runtime</scope>
         </dependency>
 
-        <!-- ===== KingbaseES (人大金仓) JDBC Driver ===== -->
         <!--
-            KingbaseES JDBC driver is NOT available on Maven Central.
-            Install it manually before building:
-              mvn install:install-file \\
-                -Dfile=/path/to/kingbase8-8.6.0.jar \\
-                -DgroupId=com.kingbase8 \\
-                -DartifactId=kingbase8 \\
-                -Dversion=8.6.0 \\
-                -Dpackaging=jar
-
-            Or configure a private Maven repository that hosts the driver.
-            The driver JAR can be obtained from the KingbaseES installation
-            directory: ${KINGBASE_HOME}/Interface/jdbc/kingbase8-8.6.0.jar
+            KingbaseES (人大金仓) JDBC driver is NOT on Maven Central, so it is
+            declared in the opt-in `kingbase` Maven profile instead of here.
+            The default build never resolves it. To build with KingbaseES:
+              1. install the driver:  mvn install:install-file \
+                   -Dfile=${KINGBASE_HOME}/Interface/jdbc/kingbase8-8.6.0.jar \
+                   -DgroupId=com.kingbase8 -DartifactId=kingbase8 \
+                   -Dversion=8.6.0 -Dpackaging=jar
+              2. build with the profile:  mvn package -Pkingbase
+            No Java code imports com.kingbase8.* — the driver is loaded at
+            runtime via spring.datasource.driver-class-name only.
         -->
-        <dependency>
-            <groupId>com.kingbase8</groupId>
-            <artifactId>kingbase8</artifactId>
-            <version>8.6.0</version>
-            <scope>runtime</scope>
-        </dependency>
 
         <!-- ===== Spring Boot Test ===== -->
         <dependency>
@@ -503,5 +494,24 @@
                 </plugins>
             </build>
         </profile>
+
+        <!--
+          Profile: KingbaseES (人大金仓) JDBC driver.
+          The driver is not published to Maven Central, so it is kept out of the
+          default build to keep `mvn package` resolvable for everyone. Install the
+          driver into the local repository, then build with `mvn package -Pkingbase`.
+          Runtime selection is via the `kingbase` Spring profile (application-kingbase.yml).
+        -->
+        <profile>
+            <id>kingbase</id>
+            <dependencies>
+                <dependency>
+                    <groupId>com.kingbase8</groupId>
+                    <artifactId>kingbase8</artifactId>
+                    <version>8.6.0</version>
+                    <scope>runtime</scope>
+                </dependency>
+            </dependencies>
+        </profile>
     </profiles>
 </project>

mateclaw-server/src/main/resources/application.yml

@@ -131,8 +131,6 @@ mateclaw:
     # Set this when agents deliver download links to channels/clients that cannot
     # resolve a relative URL (IM messages, copied links, external downloads).
     public-base-url: ${MATECLAW_PUBLIC_BASE_URL:}
-  browser:
-    ssrf-check-enabled: false
   jwt:
     secret: ${JWT_SECRET:MateClaw-JWT-Secret-Key-2024-Please-Change-In-Production}
     expiration: 86400000