后台新增RBAC权限模型支持按角色配置接单管理权限

- 新增 admin_roles/admin_permissions/admin_role_permissions 三表与种子数据(059迁移)
- 接单平台全部管理路由从固定角色切换为细粒度权限校验
- 撤单按动作二次校验:退回大厅与取消订单分别要求对应权限
- 管理员账号页新增角色权限配置卡片(admin专属,带审计日志)
- 权限更新走事务保证原子性;session实时解析权限确保修改立即生效

apps/backend/src/db/migrations/059_admin_rbac.sql

@@ -0,0 +1,87 @@
+-- 后台 RBAC 权限模型。保留 admin_users.role 兼容旧账号，权限通过角色键动态解析。
+CREATE TABLE IF NOT EXISTS admin_roles (
+  role_key TEXT PRIMARY KEY,
+  role_name TEXT NOT NULL,
+  description TEXT NOT NULL DEFAULT '',
+  is_system BOOLEAN NOT NULL DEFAULT TRUE,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE TABLE IF NOT EXISTS admin_permissions (
+  permission_key TEXT PRIMARY KEY,
+  permission_name TEXT NOT NULL,
+  permission_group TEXT NOT NULL DEFAULT '',
+  description TEXT NOT NULL DEFAULT '',
+  is_system BOOLEAN NOT NULL DEFAULT TRUE,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE TABLE IF NOT EXISTS admin_role_permissions (
+  role_key TEXT NOT NULL REFERENCES admin_roles(role_key) ON DELETE CASCADE,
+  permission_key TEXT NOT NULL REFERENCES admin_permissions(permission_key) ON DELETE CASCADE,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  PRIMARY KEY (role_key, permission_key)
+);
+
+INSERT INTO admin_roles (role_key, role_name, description)
+VALUES
+  ('admin', '管理员', '拥有全部后台权限'),
+  ('operator', '普通运营', '负责接单平台和订单运营'),
+  ('support', '客服', '负责客服处理和售后协助')
+ON CONFLICT (role_key) DO UPDATE SET
+  role_name = EXCLUDED.role_name,
+  description = EXCLUDED.description,
+  updated_at = NOW();
+
+INSERT INTO admin_permissions (permission_key, permission_name, permission_group, description)
+VALUES
+  ('worker_order.view', '查看接单订单', '接单管理', '查看接单平台订单及详情'),
+  ('worker_order.edit', '编辑接单订单', '接单管理', '修改接单订单基础资料'),
+  ('worker_order.configure_share', '配置拼单', '接单管理', '配置接单订单拼单规则'),
+  ('worker_order.assign', '指派打手', '接单管理', '指派或取消指派打手'),
+  ('worker_order.return_to_hall', '撤单并退回大厅', '接单管理', '将进行中的订单撤回抢单大厅'),
+  ('worker_order.cancel', '撤单并取消订单', '接单管理', '取消订单并终止后续履约'),
+  ('worker_order.cancel_share', '撤销拼单参与者', '接单管理', '撤销拼单中的单个参与者'),
+  ('worker_order.delete', '删除接单订单', '接单管理', '删除尚未履约的接单订单'),
+  ('worker_order.publish', '发布接单订单', '接单管理', '发布或下架接单订单'),
+  ('worker_order.accept', '验收接单订单', '接单管理', '验收接单订单和拼单份额'),
+  ('worker_order.reopen', '重新启用订单', '接单管理', '重新启用已取消的接单订单'),
+  ('worker_order.update_material', '更新订单资料', '接单管理', '补充或更新订单资料'),
+  ('worker_order.manage_problem', '处理问题单', '接单管理', '标记和处置问题单'),
+  ('worker_order.deduct_deposit', '扣除押金', '接单管理', '处理待解冻押金'),
+  ('worker_cancel_request.review', '审核撤单申请', '接单管理', '审核打手提交的撤单申请')
+ON CONFLICT (permission_key) DO UPDATE SET
+  permission_name = EXCLUDED.permission_name,
+  permission_group = EXCLUDED.permission_group,
+  description = EXCLUDED.description,
+  updated_at = NOW();
+
+-- 管理员默认拥有全部已登记权限。
+INSERT INTO admin_role_permissions (role_key, permission_key)
+SELECT 'admin', permission_key FROM admin_permissions
+ON CONFLICT DO NOTHING;
+
+-- 普通运营保持现有完整接单操作；客服默认不拥有高风险直接撤单权限。
+INSERT INTO admin_role_permissions (role_key, permission_key)
+SELECT 'operator', permission_key
+FROM admin_permissions
+ON CONFLICT DO NOTHING;
+
+INSERT INTO admin_role_permissions (role_key, permission_key)
+SELECT 'support', permission_key
+FROM admin_permissions
+WHERE permission_key IN (
+  'worker_order.view',
+  'worker_order.edit',
+  'worker_order.assign',
+  'worker_order.publish',
+  'worker_order.update_material',
+  'worker_order.manage_problem',
+  'worker_cancel_request.review'
+)
+ON CONFLICT DO NOTHING;
+
+CREATE INDEX IF NOT EXISTS idx_admin_role_permissions_permission
+  ON admin_role_permissions(permission_key, role_key);