后台新增RBAC权限模型支持按角色配置接单管理权限

- 新增 admin_roles/admin_permissions/admin_role_permissions 三表与种子数据(059迁移)
- 接单平台全部管理路由从固定角色切换为细粒度权限校验
- 撤单按动作二次校验:退回大厅与取消订单分别要求对应权限
- 管理员账号页新增角色权限配置卡片(admin专属,带审计日志)
- 权限更新走事务保证原子性;session实时解析权限确保修改立即生效

apps/backend/src/services/worker-platform/admin-work-order-cancellation-service.ts

@@ -55,6 +55,7 @@ export async function cancelAdminWorkOrder(
   workOrderId: number | string,
   payload: JsonObject = {},
   actorName = '',
+  actorPermissions: string[] = [],
 ) {
   const workOrder = await getRequiredWorkOrder(workOrderId)
   if (workOrder.status !== WORK_ORDER_STATUS.IN_PROGRESS || !workOrder.assigned_worker_id) {
@@ -70,6 +71,14 @@ export async function cancelAdminWorkOrder(
       errorCode: 'work_order_cancel_action_required',
     })
   }
+  const requiredPermission =
+    action === 'return_to_hall' ? 'worker_order.return_to_hall' : 'worker_order.cancel'
+  if (!actorPermissions.includes(requiredPermission)) {
+    throw createHttpError('当前账号没有此撤单权限', {
+      statusCode: 403,
+      errorCode: 'admin_permission_denied',
+    })
+  }
   const reason = String(payload.reason || '').trim()
   if (action === 'cancel_order' && !reason) {
     throw createHttpError('取消订单时请填写退款或撤单原因', {