feat(awooop): gate approved ssh execution

docs/LOGBOOK.md

@@ -7020,3 +7020,47 @@ first_gateway_tool=legacy:ssh_host:ssh_get_nginx_error_log result=failed
 gate_schema=legacy_mcp_bridge_v1 policy_enforced=False
 not_used_reason=legacy direct provider path; bridge audit only
 ```
+
+### 2026-05-13 — AwoooP MCP Gateway T9：approved SSH execution 接入五閘門（local green）
+
+**目的**：
+
+- 將 Telegram / Approval 已批准的 SSH 修復執行路徑，從 `legacy_direct_provider` 推進到 first-class `McpGateway`。
+- write/admin SSH tool 不自動放行；由已批准的 `ApprovalRequest` 投影短效 Gate 5 Redis key，再由 Gateway 驗證 agent/tool/grant/env/approval 並寫 `awooop_mcp_gateway_audit`。
+
+**變更**：
+
+- `ApprovalExecutionService._execute_ssh_host_action()` 改走 `approval_executor` + `McpGateway`。
+- `ssh_diagnose` 走 read scope，不投影 Gate 5 key。
+- `ssh_docker_restart` / `ssh_systemctl_restart` 等 write tool 走 write scope。
+- `ssh_docker_prune` 走 admin scope。
+- 新增 migration seed：
+  - `awooop_awoooi_mcp_approval_executor_ssh_gateway_2026-05-13.sql`
+  - `awooop_awoooi_mcp_approval_executor_ssh_gateway_2026-05-13_down.sql`
+
+**local verification**：
+
+```text
+python -m pytest tests/test_mcp_gateway_gate5.py tests/test_approval_execution_mcp_audit.py -q
+5 passed
+
+python -m ruff check --select F821 src/services/approval_execution.py tests/test_approval_execution_mcp_audit.py
+All checks passed
+
+python -m py_compile src/services/approval_execution.py tests/test_approval_execution_mcp_audit.py
+OK
+
+bash -n scripts/ops/notify-awoooi-ops.sh scripts/backup/backup-momo-188-pg.sh
+OK
+
+ruby -e 'require "yaml"; YAML.load_file("infra/ansible/playbooks/188-ai-web.yml")'
+yaml ok
+```
+
+**目前整體進度**：約 64%。
+
+- Wave 0 backup 接線：完成並已部署。
+- T1-T6 truth-chain / run-state / alert event / bridge / status 收斂：完成。
+- T7 read-only pre-decision MCP Gateway：完成並已產線 smoke。
+- T8 post-execution verifier MCP Gateway：完成並已產線 smoke。
+- T9 approved SSH execution Gateway：local green，待 Gitea run-migration / CD / production smoke。