feat(arch-scan): add @public JSDoc tag exemption mechanism for Server Actions

scripts/arch-scan/query.test.ts

@@ -103,4 +103,17 @@ describe("queryViolations", () => {
     );
     expect(missing).toBeDefined();
   });
+
+  it("should exclude @public Server Actions from violations", () => {
+    const db = setupTestDb();
+    // 插入一个带 @public 标记的 Server Action（豁免权限校验）
+    db.prepare(
+      "INSERT INTO symbols (file_id, name, kind, is_exported, is_async, is_server_action, is_public, start_line, end_line) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"
+    ).run(1, "publicLoginAction", "function", 1, 1, 1, 1, 60, 100);
+    const violations = queryViolations(db);
+    const missing = violations.server_actions_without_permission.find(
+      (v) => v.name === "publicLoginAction"
+    );
+    expect(missing).toBeUndefined();
+  });
 });