实现账号信息隐藏权限系统

1. 拆分 account:view_all 和 account:view_full 权限
2. 运营只能看用户名、标签、分配，隐藏密码/邮箱等敏感信息
3. 管理员可看完整字段（需 account:view_full 权限）
4. 所有人都可分配账号给客服
5. 前端添加上传时间列

web/backend/permissions.py

@@ -9,8 +9,9 @@ PERMISSIONS = {
     "user:delete": "删除用户",
     "user:assign_permissions": "分配权限",
     # 账号管理
-    "account:view_all": "查看所有账号（完整字段）",
+    "account:view_all": "查看所有账号（仅用户名、标签、分配）",
-    "account:view_assigned": "查看分配给自己的账号（仅用户名）",
+    "account:view_full": "查看账号完整字段（密码/邮箱，仅管理员）",
+    "account:view_assigned": "查看分配给自己的账号",
     "account:import": "导入账号",
     "account:assign": "分配账号给客服",
     "account:delete": "删除账号",
@@ -37,7 +38,6 @@ ROLE_PERMISSIONS = {
         "account:view_all",
         "account:import",
         "account:assign",
-        "account:delete",
         "login:batch",
         "login:view_all",
         "cookie:view",

web/backend/routers/accounts.py

@@ -54,8 +54,8 @@ def list_accounts(
             assigned_username=acc.assigned_user.username if acc.assigned_user else None,
             created_at=acc.created_at,
         )
-        # 运营+超管可看完整字段
+        # 只有管理员可看完整字段（密码、邮箱等）
-        if user_has_permission(current, "account:view_all"):
+        if user_has_permission(current, "account:view_full"):
             item.password = acc.password
             item.email = acc.email
             item.email_password = acc.email_password

web/frontend/src/pages/AccountsPage.tsx

@@ -7,6 +7,7 @@ import type { TableProps } from 'antd';
 import { ImportOutlined, DeleteOutlined, TagOutlined, FilterOutlined } from '@ant-design/icons';
 import { accountApi, userApi, type AccountItem, type UserInfo } from '../api/modules';
 import { usePermissions } from '../hooks/usePermissions';
+import { formatTime } from '../utils/time';
 import { getErrorMessage } from '../utils/error';
 
 const { TextArea } = Input;
@@ -36,6 +37,7 @@ export default function AccountsPage() {
   const { can } = usePermissions();
 
   const canViewAll = can('account:view_all');
+  const canViewFull = can('account:view_full');
   const canImport = can('account:import');
   const canAssign = can('account:assign');
   const canDelete = can('account:delete');
@@ -218,9 +220,16 @@ export default function AccountsPage() {
         return <Tag color={tagColorMap[tag]}>{tag}</Tag>;
       },
     },
+    {
+      title: '上传时间',
+      dataIndex: 'created_at',
+      width: 180,
+      render: (val: string | null) => val ? formatTime(val) : <Text type="secondary">-</Text>,
+    },
   ];
 
-  if (canViewAll) {
+  // 只有管理员可看完整字段（密码、邮箱等）
+  if (canViewFull) {
     columns.push(
       { title: '密码', dataIndex: 'password', width: 120 },
       { title: '邮箱', dataIndex: 'email' },