后台新增RBAC权限模型支持按角色配置接单管理权限

- 新增 admin_roles/admin_permissions/admin_role_permissions 三表与种子数据(059迁移)
- 接单平台全部管理路由从固定角色切换为细粒度权限校验
- 撤单按动作二次校验:退回大厅与取消订单分别要求对应权限
- 管理员账号页新增角色权限配置卡片(admin专属,带审计日志)
- 权限更新走事务保证原子性;session实时解析权限确保修改立即生效

apps/frontend/src/layouts/AdminLayout.tsx

@@ -32,10 +32,11 @@ import {
 } from 'antd'
 import type { MenuProps } from 'antd'
 import { useQuery, useQueryClient } from '@tanstack/react-query'
-import { useMemo, useState } from 'react'
+import { useEffect, useMemo, useState } from 'react'
 import { Outlet, useLocation, useNavigate } from 'react-router'
 
 import {
+  fetchAdminSession,
   fetchAdminNotifications,
   fetchDevMockStatus,
   logoutAdmin,
@@ -47,6 +48,7 @@ import {
   getAdminToken,
   getAdminTokenExpiresAt,
   getAdminUsername,
+  setAdminPermissions,
 } from '@/utils/admin-auth'
 import { formatAdminDateTime } from '@/utils/admin-time'
 import { useRealtimeEvents, type RealtimeEvent } from '@/hooks/useRealtimeEvents'
@@ -69,6 +71,19 @@ export default function AdminLayout() {
     () => window.localStorage.getItem(NOTIFICATION_SOUND_KEY) === '1',
   )
 
+  const adminSessionQuery = useQuery({
+    queryKey: ['admin-session'],
+    queryFn: fetchAdminSession,
+    retry: false,
+  })
+
+  useEffect(() => {
+    const session = adminSessionQuery.data?.data
+    if (session?.authenticated && session.user) {
+      setAdminPermissions(session.user.permissions || [])
+    }
+  }, [adminSessionQuery.data])
+
   const devMockStatusQuery = useQuery({
     queryKey: ['admin-dev-mock-status'],
     queryFn: () => fetchDevMockStatus(),
@@ -546,7 +561,12 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 type NotificationAlertKind =
-  'withdraw' | 'recharge' | 'acceptance' | 'material' | 'reminder' | 'default'
+  | 'withdraw'
+  | 'recharge'
+  | 'acceptance'
+  | 'material'
+  | 'reminder'
+  | 'default'
 
 function playNotificationSound(kind: NotificationAlertKind) {
   try {