[Story]: Content-exclusion glob configuration data model and admin API

## Summary
Build the data model and admin API for repo/org-level content-exclusion glob configuration.

## Intent / Source of truth
This is the configuration surface the enforcement story (a6s2) reads from; needed first. Part of [Epic] Content and path exclusion controls.

## Scope
- [ ] Exclusion-rule data model (org/repo/path glob, scope, created-by)
- [ ] Admin CRUD API for exclusion rules
- [ ] Validation of glob syntax and scope conflicts

## Out of scope
- Enforcement in the indexing pipeline (separate cross-repo story)

## Verification
CRUD API tests; glob validation rejects malformed patterns with a clear error.

## Risk assessment
Low risk in isolation — the real risk is in enforcement (a6s2), not the config surface itself.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.

Start by locating the existing admin API and data-model patterns in the Rust service, then trace how the enforcement story a6s2 will read this configuration. Cover org/repo/path-glob fields, scope and creator handling, CRUD behavior, and malformed-glob or scope-conflict validation. Done means CRUD API tests pass and invalid patterns return clear errors.

由索引模型根据 Issue 内容生成。