feat: Add Outdoor Fair Attendee and Device management

- Implemented Outdoor Fair Attendee and Device entities, including their respective controllers, services, and mappers.
- Added statistics endpoint for Outdoor Fair data, allowing aggregation by day, week, month, or year.
- Introduced SQL scripts for creating tables and mock data for attendees and devices.
- Created a write-capable script for executing DML/DDL statements against the SHZ HighGo database.
- Enhanced the existing query capabilities to support both read and write operations.

.claude/skills/query-shz-highgo/SKILL.md

@@ -1,13 +1,18 @@
 ---
 name: query-shz-highgo
-description: Query the SHZ HighGo Security Enterprise Edition database through its SSH gateway using a guarded read-only psql workflow. Use when Claude Code is working in the shz-backend project and needs to inspect database schemas, tables, columns, row counts, or application data; diagnose data-related behavior; or execute SELECT, WITH, SHOW, or EXPLAIN statements against the project's HighGo database.
+description: Run SQL against the SHZ HighGo Security Enterprise Edition database through its SSH gateway. Use when Claude Code is working in the shz-backend project and needs to inspect schemas, tables, columns, row counts, or application data; diagnose data-related behavior; or execute SELECT/WITH/SHOW/EXPLAIN. Also supports write operations — INSERT, UPDATE, DELETE, MERGE, CREATE, ALTER, DROP, TRUNCATE, GRANT, REVOKE — when the user explicitly asks to add, modify, delete, or otherwise change data or schema.
 ---
 
-# Query SHZ HighGo
+# SHZ HighGo SQL
 
-Use the bundled script to run read-only SQL through the configured SSH gateway.
+Two bundled scripts run SQL through the configured SSH gateway:
 
-## Query workflow
+- `scripts/query.sh` — **read-only**. Default for inspection and diagnostics.
+- `scripts/modify.sh` — **write-capable**. Use only when an actual change is intended and the user has asked for it.
+
+Both set `search_path` to `shz,public`, apply a 30-second `statement_timeout`, reject multiple statements in one call, and base64-encode the SQL over the SSH channel. `query.sh` additionally enforces database-level `default_transaction_read_only=on` and accepts only `SELECT/WITH/SHOW/EXPLAIN`.
+
+## Query workflow (read-only)
 
 1. Form the narrowest useful query. Add a small `LIMIT` when inspecting rows.
 2. For unfamiliar tables, inspect `information_schema.columns` before selecting business data.
@@ -19,7 +24,26 @@ Use the bundled script to run read-only SQL through the configured SSH gateway.
 
 4. Summarize the result and distinguish returned facts from inferences.
 
-The script accepts only statements beginning with `SELECT`, `WITH`, `SHOW`, or `EXPLAIN`, rejects multiple statements, sets `search_path` to `shz,public`, enforces database-level read-only mode, and applies a 30-second timeout. Never bypass these controls or perform writes unless the user explicitly requests a separate write-capable workflow.
+## Modify workflow (writes)
+
+⚠️ These statements change data or schema on a production database. Confirm the exact statement with the user before running it, and prefer a `WHERE` clause or scoped target. Read unfamiliar tables with `query.sh` first.
+
+1. Inspect the target with `query.sh` (columns, existing rows) so the statement is well-formed.
+2. Run the write:
+
+   ```bash
+   .claude/skills/query-shz-highgo/scripts/modify.sh "INSERT INTO shz.some_table (col) VALUES ('val')"
+   .claude/skills/query-shz-highgo/scripts/modify.sh "UPDATE shz.some_table SET col = 'val' WHERE id = 1"
+   .claude/skills/query-shz-highgo/scripts/modify.sh "DELETE FROM shz.some_table WHERE id = 1"
+   .claude/skills/query-shz-highgo/scripts/modify.sh "CREATE TABLE shz.example (id bigint PRIMARY KEY)"
+   ```
+
+3. Verify the effect with a follow-up `query.sh` `SELECT` and report rows affected.
+
+Notes:
+- Only one statement per call. To run several, invoke the script multiple times.
+- Transactions across calls are NOT supported (each call is its own session). psql autocommits each statement.
+- `DROP`/`TRUNCATE`/`DELETE` without a `WHERE` are destructive — re-state the impact to the user and wait for explicit go-ahead.
 
 ## Schema discovery