后台新增RBAC权限模型支持按角色配置接单管理权限

- 新增 admin_roles/admin_permissions/admin_role_permissions 三表与种子数据(059迁移)
- 接单平台全部管理路由从固定角色切换为细粒度权限校验
- 撤单按动作二次校验:退回大厅与取消订单分别要求对应权限
- 管理员账号页新增角色权限配置卡片(admin专属,带审计日志)
- 权限更新走事务保证原子性;session实时解析权限确保修改立即生效

apps/backend/src/routes/admin/session.ts

@@ -80,6 +80,45 @@ export function requireAdminRoles(allowedRoles: string[]) {
   }
 }
 
+export function requireAdminPermission(permission: string) {
+  return (req: Request, res: Response, next: NextFunction): void => {
+    try {
+      const session = getRequiredAdminSession(req)
+      if (!session.permissions.includes(String(permission || '').trim())) {
+        throw createHttpError('当前账号没有此操作权限', {
+          statusCode: 403,
+          errorCode: 'admin_permission_denied',
+        })
+      }
+      next()
+    } catch (error) {
+      sendRouteError(res, error, '后台鉴权失败', '[admin/auth/permission]')
+    }
+  }
+}
+
+export function requireAnyAdminPermission(permissions: string[]) {
+  return (req: Request, res: Response, next: NextFunction): void => {
+    try {
+      const session = getRequiredAdminSession(req)
+      if (
+        permissions.some((permission) =>
+          session.permissions.includes(String(permission || '').trim()),
+        )
+      ) {
+        next()
+        return
+      }
+      throw createHttpError('当前账号没有此操作权限', {
+        statusCode: 403,
+        errorCode: 'admin_permission_denied',
+      })
+    } catch (error) {
+      sendRouteError(res, error, '后台鉴权失败', '[admin/auth/permission]')
+    }
+  }
+}
+
 export function getRequiredAdminSession(req: Request): AdminSession {
   if (req.adminSession) {
     return req.adminSession