后台新增RBAC权限模型支持按角色配置接单管理权限

- 新增 admin_roles/admin_permissions/admin_role_permissions 三表与种子数据(059迁移)
- 接单平台全部管理路由从固定角色切换为细粒度权限校验
- 撤单按动作二次校验:退回大厅与取消订单分别要求对应权限
- 管理员账号页新增角色权限配置卡片(admin专属,带审计日志)
- 权限更新走事务保证原子性;session实时解析权限确保修改立即生效

apps/frontend/src/utils/admin-auth.ts

@@ -3,6 +3,7 @@ const ADMIN_EXPIRES_AT_KEY = 'order-site-admin-token-expires-at'
 const ADMIN_USER_ID_KEY = 'order-site-admin-user-id'
 const ADMIN_USERNAME_KEY = 'order-site-admin-username'
 const ADMIN_ROLE_KEY = 'order-site-admin-role'
+const ADMIN_PERMISSIONS_KEY = 'order-site-admin-permissions'
 
 const ADMIN_ROLE_LEVEL: Record<'support' | 'operator' | 'admin', number> = {
   support: 1,
@@ -36,6 +37,26 @@ export function getAdminRole() {
   return 'support'
 }
 
+export function getAdminPermissions(): string[] {
+  try {
+    const value = JSON.parse(localStorage.getItem(ADMIN_PERMISSIONS_KEY) || '[]')
+    return Array.isArray(value)
+      ? value.map((item) => String(item || '').trim()).filter(Boolean)
+      : []
+  } catch {
+    return []
+  }
+}
+
+export function setAdminPermissions(permissions: string[]) {
+  localStorage.setItem(ADMIN_PERMISSIONS_KEY, JSON.stringify(permissions || []))
+}
+
+export function hasAdminPermission(permission: string) {
+  if (!hasAdminSession()) return false
+  return getAdminPermissions().includes(String(permission || '').trim())
+}
+
 export function hasAdminRole(role: 'admin' | 'operator' | 'support') {
   if (!hasAdminSession()) {
     return false
@@ -47,7 +68,12 @@ export function hasAdminRole(role: 'admin' | 'operator' | 'support') {
 export function setAdminSession(
   token: string,
   expiresAt: string,
-  user?: { userId: number; username: string; role: 'admin' | 'operator' | 'support' },
+  user?: {
+    userId: number
+    username: string
+    role: 'admin' | 'operator' | 'support'
+    permissions?: string[]
+  },
 ) {
   localStorage.setItem(ADMIN_TOKEN_KEY, token)
   localStorage.setItem(ADMIN_EXPIRES_AT_KEY, expiresAt)
@@ -63,6 +89,8 @@ export function setAdminSession(
   if (user?.role) {
     localStorage.setItem(ADMIN_ROLE_KEY, user.role)
   }
+
+  localStorage.setItem(ADMIN_PERMISSIONS_KEY, JSON.stringify(user?.permissions || []))
 }
 
 export function clearAdminSession() {
@@ -71,6 +99,7 @@ export function clearAdminSession() {
   localStorage.removeItem(ADMIN_USER_ID_KEY)
   localStorage.removeItem(ADMIN_USERNAME_KEY)
   localStorage.removeItem(ADMIN_ROLE_KEY)
+  localStorage.removeItem(ADMIN_PERMISSIONS_KEY)
 }
 
 export function hasAdminSession() {