feat(asset): 清理被截断的结尾图片引用，修复整单 502

仓库首次入库（此前仅存在于本地工作区与测试服构建产物中，未上传）。

改动（src/knowledge_adapter/asset_content_processor.py）：
- 新增 _TRUNCATED_TRAILING_MARKDOWN_RESOURCE_IMAGE 规则，清除 chunk 末尾被截断的
  ![](resource://xxxx 残片（WeKnora 分块在图片引用中间截断时产生，旧逻辑无法匹配完整引用，
  残留 resource:// 触发 ContentProcessingError，导致整单 502）
- 回归测试 tests/test_asset_content_processor.py::
  test_truncated_trailing_markdown_resource_image_is_removed

验证证据：
- 测试服 120.76.217.51，镜像 knowledge-adapter-service:reviewed-test-aeab4b5fca2d
  （release aeab4b5fca2d8661）：KB d015d05c-25c8-4d63-b2ab-e8590d3c2dfb 5 个查询全部
  http=200、records=5、残留 resource:// = 0；KB b9dacd62 无退化；容器日志无 error/exception
- 本地：pytest 141 项全通过、ruff 全通过
- 该文件与 258c31e0fe07fd08 源码的差异经逐文件 md5 比对，为唯一变更文件

deploy/sql/weknora_readonly_grants.sql

@@ -0,0 +1,15 @@
+\set ON_ERROR_STOP on
+
+-- Run with: psql ... --set=adapter_role=knowledge_adapter_weknora_ro -f this-file
+-- The named role must be a dedicated NOINHERIT login with no other memberships.
+BEGIN;
+
+REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM :"adapter_role";
+REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM :"adapter_role";
+REVOKE CREATE ON SCHEMA public FROM :"adapter_role";
+
+GRANT USAGE ON SCHEMA public TO :"adapter_role";
+GRANT SELECT (handle, tenant_id, storage_backend_id, provider, physical_path, mime_type, state, deleted_at)
+    ON TABLE public.resources TO :"adapter_role";
+
+COMMIT;