chore(perms): unblock 'git reset --hard' (move from deny to prompt)

- Removed Bash(git reset --hard*) and Bash(git clean -fd*) from deny list.
- git reset --hard and git clean -fd are not in allow either, so Claude
  will prompt for confirmation each time (safest middle ground).
- git clean -fdx remains denied (removes ignored files = dangerous).
- Updated CLAUDE.md permission summary to reflect new model.

.claude/settings.json

@@ -321,8 +321,6 @@
       "Bash(git push -f*)",
       "Bash(git push origin main*)",
       "Bash(git push origin master*)",
-      "Bash(git reset --hard*)",
-      "Bash(git clean -fd*)",
       "Bash(git clean -fdx*)",
       "Bash(git commit --amend*)",
       "Bash(git filter-branch*)",

CLAUDE.md

@@ -131,8 +131,11 @@
 
 **硬拦截：**
 - ❌ 任何 Azure 资源的 create/update/delete/restart
-- ❌ `git push --force`、`git commit --amend`、`git reset --hard`
+- ❌ `git push --force`、`git commit --amend`、`git clean -fdx`
 - ❌ `gh pr merge`、`gh pr review --approve`
+
+**需人类每次确认（不在 deny 但也不在 allow）：**
+- ⚠️ `git reset --hard`（破坏性但有合法场景，每次 prompt 让人类决策）
 - ❌ `alembic downgrade`、生产 DB 的 DROP/UPDATE
 - ❌ `rm -rf /*`、`sudo`、`chmod 777`
 - ❌ 读取 `.env` / `secrets/**` / casdoor `app.conf`