feat: harden data access and simplify user management

scripts/enable_managed_dbeaver_access.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+# MySQL only runs docker-entrypoint-initdb.d scripts for a new data volume.
+# Run this once after upgrading an existing deployment so the dedicated
+# account-provisioning user receives its narrowly scoped privileges.
+docker compose exec -T mysql \
+  sh /docker-entrypoint-initdb.d/01-data-center-grants.sh
+
+echo "DBeaver 管理接入的独立 MySQL 签发账号已配置。"