后台新增RBAC权限模型支持按角色配置接单管理权限

- 新增 admin_roles/admin_permissions/admin_role_permissions 三表与种子数据(059迁移)
- 接单平台全部管理路由从固定角色切换为细粒度权限校验
- 撤单按动作二次校验:退回大厅与取消订单分别要求对应权限
- 管理员账号页新增角色权限配置卡片(admin专属,带审计日志)
- 权限更新走事务保证原子性;session实时解析权限确保修改立即生效

apps/backend/src/services/admin/admin-auth-service.ts

@@ -20,6 +20,7 @@ import { addHours, nowIso } from '../../utils/time.js'
 import { createHttpError } from '../../utils/http.js'
 import { normalizePage, normalizePageSize } from './admin-query-utils.js'
 import { recordAdminLoginLog } from './admin-login-log-service.js'
+import { listAdminPermissionKeysForRole } from './admin-rbac-service.js'
 
 type AdminUserRow = NonNullable<Awaited<ReturnType<typeof getAdminUserById>>>
 
@@ -30,6 +31,7 @@ export type AdminSession = {
   role: AdminRole
   expiresAt: string
   sessionVersion: number
+  permissions: string[]
 }
 
 type AdminRole = 'admin' | 'operator' | 'support'
@@ -230,6 +232,7 @@ export async function verifyAdminSessionToken(token: unknown): Promise<AdminSess
     role: normalizeAdminRole(user.role),
     expiresAt,
     sessionVersion: currentSessionVersion,
+    permissions: await listAdminPermissionKeysForRole(normalizeAdminRole(user.role)),
   }
 }
 
@@ -249,6 +252,7 @@ export async function getAdminSessionSummary(token: unknown): Promise<JsonObject
       userId: session.userId,
       username: session.username,
       role: session.role,
+      permissions: session.permissions,
     },
   }
 }