feat(ft546): enforce shadow database isolation

ruoyi-wcs-shadow/src/main/java/com/ruoyi/shadow/config/SqlServerReadOnlyTransactionManager.java

@@ -0,0 +1,38 @@
+package com.ruoyi.shadow.config;
+
+import org.springframework.jdbc.datasource.DataSourceTransactionManager;
+import org.springframework.transaction.TransactionDefinition;
+
+import javax.sql.DataSource;
+import java.sql.Connection;
+
+/**
+ * Rejects write-capable transaction definitions without emitting the
+ * unsupported SQL Server statement {@code SET TRANSACTION READ ONLY}.
+ * Database permissions remain the authoritative write barrier.
+ */
+final class SqlServerReadOnlyTransactionManager
+        extends DataSourceTransactionManager {
+    SqlServerReadOnlyTransactionManager(DataSource dataSource) {
+        super(dataSource);
+        setEnforceReadOnly(true);
+    }
+
+    @Override
+    protected void doBegin(Object transaction,
+                           TransactionDefinition definition) {
+        if (!definition.isReadOnly()) {
+            throw new IllegalStateException(
+                    "SHADOW_SOURCE_TRANSACTION_MUST_BE_READ_ONLY");
+        }
+        super.doBegin(transaction, definition);
+    }
+
+    @Override
+    protected void prepareTransactionalConnection(
+            Connection connection, TransactionDefinition definition) {
+        // SQL Server JDBC treats Connection#setReadOnly as a hint and SQL
+        // Server does not support SET TRANSACTION READ ONLY. The source login
+        // is independently verified to have no production write permission.
+    }
+}