refactor(api): Phase 17 P1 Tier 3 紅區服務 Protocol 定義

新增 5 個紅區核心服務的 Protocol 介面：
- IDecisionManager: 決策狀態機
- ITrustScoreManager: 信任評分引擎
- IIncidentEngine: 事件處理引擎
- IMultiSigRedisService: 分散式鎖服務
- ITelegramSecurityInterceptor: 安全攔截器

符合 leWOOOgo 積木化規範：
- 支援依賴注入 (DI)
- 便於測試時 Mock
- 型別約束確保實作一致性

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/api/src/services/multi_sig_redis.py

@@ -17,6 +17,7 @@ Features:
 
 import json
 from datetime import UTC, datetime
+from typing import Protocol, runtime_checkable
 from uuid import UUID
 
 import structlog
@@ -67,6 +68,67 @@ class ApprovalStateRedis:
         return f"{APPROVAL_KEY_PREFIX}{str(approval_id)}"
 
 
+# =============================================================================
+# Protocol Interface (Phase 17 P1 - 紅區治理)
+# =============================================================================
+
+@runtime_checkable
+class IMultiSigRedisService(Protocol):
+    """
+    MultiSigRedisService 介面定義
+
+    用途:
+    - 依賴注入 (DI) 時的型別約束
+    - 測試時 Mock 的型別檢查
+    - 符合 leWOOOgo 積木化規範
+
+    Tier 3 紅區服務: 修改需首席架構師簽核
+
+    @see feedback_lewooogo_modular_enforcement.md
+    @see docs/RED_ZONES.md
+    """
+
+    async def create_approval(
+        self,
+        approval_id: str | UUID,
+        action: str,
+        description: str,
+        risk_level: str,
+        required_signatures: int,
+        namespace: str = "default",
+        resource_name: str = "",
+        blast_radius: dict | None = None,
+        dry_run_checks: list | None = None,
+    ) -> dict:
+        """建立新的簽核單"""
+        ...
+
+    async def get_approval(self, approval_id: str | UUID) -> dict | None:
+        """取得簽核狀態"""
+        ...
+
+    async def add_signature(
+        self,
+        approval_id: str | UUID,
+        signer_id: str,
+        signer_name: str,
+        comment: str = "",
+        source: str = "web",
+        telegram_user_id: int | None = None,
+        telegram_message_id: int | None = None,
+    ) -> dict:
+        """新增簽名 (含分散式鎖保護)"""
+        ...
+
+    async def update_status(
+        self,
+        approval_id: str | UUID,
+        status: str,
+    ) -> dict | None:
+        """更新簽核狀態"""
+        ...
+
+
 # =============================================================================
 # Multi-Sig Redis Service
 # =============================================================================