feat: 发布权限 RBAC + PipelineEditor 修复 + 菜单优化

- 新增 DeployRBAC 页面: Jenkins-style Item Role 权限管理
  - 正则匹配流水线 code，实时命中预览
  - 内置用户分配面板，无需跳转系统管理
  - 支持创建/编辑/删除/启用禁用 Item Role
- 修复 PipelineEditor 成员管理 http 双解包 bug
- 修复 PipelineManager 前端 code 路由迁移(delete/trigger/stop/loadRuns)
- 新增批量删除流水线运行记录 API
- Sidebar: 应用发布下新增「发布权限」, 仓库认证→发布配置, 移除用户组
- 恢复系统管理菜单(不受发布权限改动影响)
- 后端 ItemRole CRUD handler + 正则匹配中间件已就绪

backend/internal/api/handlers/deploy_groups.go

@@ -0,0 +1,151 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+
+	"ezops/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+// ==================== 用户组管理 ====================
+
+// ListGroups 用户组列表
+func (h *PipelineHandler) ListGroups(c *gin.Context) {
+	var groups []models.DeployUserGroup
+	h.db.Preload("Members").Order("created_at DESC").Find(&groups)
+	c.JSON(http.StatusOK, models.Response{Code: 200, Data: models.ListResponse{List: groups, Total: int64(len(groups))}})
+}
+
+// CreateGroup 创建用户组
+func (h *PipelineHandler) CreateGroup(c *gin.Context) {
+	var req struct {
+		Name        string `json:"name" binding:"required"`
+		Description string `json:"description"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, models.Response{Code: 400, Message: err.Error()})
+		return
+	}
+	group := models.DeployUserGroup{
+		Name: req.Name, Description: req.Description,
+		CreatedBy: c.GetString("username"),
+	}
+	if err := h.db.Create(&group).Error; err != nil {
+		c.JSON(http.StatusConflict, models.Response{Code: 409, Message: "组名已存在: " + err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, models.Response{Code: 200, Data: group})
+}
+
+// UpdateGroup 更新用户组
+func (h *PipelineHandler) UpdateGroup(c *gin.Context) {
+	id, _ := strconv.Atoi(c.Param("id"))
+	var group models.DeployUserGroup
+	if err := h.db.First(&group, id).Error; err != nil {
+		c.JSON(http.StatusNotFound, models.Response{Code: 404, Message: "不存在"})
+		return
+	}
+	var req struct {
+		Name        *string `json:"name"`
+		Description *string `json:"description"`
+	}
+	c.ShouldBindJSON(&req)
+	updates := map[string]interface{}{}
+	if req.Name != nil { updates["name"] = *req.Name }
+	if req.Description != nil { updates["description"] = *req.Description }
+	h.db.Model(&group).Updates(updates)
+	h.db.First(&group, id)
+	c.JSON(http.StatusOK, models.Response{Code: 200, Data: group})
+}
+
+// DeleteGroup 删除用户组
+func (h *PipelineHandler) DeleteGroup(c *gin.Context) {
+	id := c.Param("id")
+	// 先删组成员和流水线授权
+	h.db.Where("group_id = ?", id).Delete(&models.DeployUserGroupMember{})
+	h.db.Where("group_id = ?", id).Delete(&models.DeployPipelineMember{})
+	h.db.Delete(&models.DeployUserGroup{}, id)
+	c.JSON(http.StatusOK, models.Response{Code: 200, Message: "已删除"})
+}
+
+// ==================== 用户组成员管理 ====================
+
+// ListGroupMembers 组成员列表
+func (h *PipelineHandler) ListGroupMembers(c *gin.Context) {
+	groupID, _ := strconv.Atoi(c.Param("id"))
+	var members []models.DeployUserGroupMember
+	h.db.Where("group_id = ?", groupID).Find(&members)
+	c.JSON(http.StatusOK, models.Response{Code: 200, Data: members})
+}
+
+// AddGroupMember 添加组成员
+func (h *PipelineHandler) AddGroupMember(c *gin.Context) {
+	groupID, _ := strconv.Atoi(c.Param("id"))
+	var req struct {
+		Username string `json:"username" binding:"required"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, models.Response{Code: 400, Message: err.Error()})
+		return
+	}
+	member := models.DeployUserGroupMember{GroupID: uint(groupID), Username: req.Username}
+	if err := h.db.Create(&member).Error; err != nil {
+		c.JSON(http.StatusConflict, models.Response{Code: 409, Message: "该用户已在组内"})
+		return
+	}
+	c.JSON(http.StatusOK, models.Response{Code: 200, Data: member})
+}
+
+// RemoveGroupMember 移除组成员
+func (h *PipelineHandler) RemoveGroupMember(c *gin.Context) {
+	groupID, _ := strconv.Atoi(c.Param("id"))
+	memberID, _ := strconv.Atoi(c.Param("memberId"))
+	result := h.db.Where("id = ? AND group_id = ?", memberID, groupID).Delete(&models.DeployUserGroupMember{})
+	if result.RowsAffected == 0 {
+		c.JSON(http.StatusNotFound, models.Response{Code: 404, Message: "成员不存在"})
+		return
+	}
+	c.JSON(http.StatusOK, models.Response{Code: 200, Message: "已移除"})
+}
+
+// ==================== 组授权给流水线 ====================
+
+// AssignGroupToPipeline 将用户组授权到流水线
+func (h *PipelineHandler) AssignGroupToPipeline(c *gin.Context) {
+	pipelineID := getPipelineID(c)
+	var req struct {
+		GroupID uint   `json:"group_id" binding:"required"`
+		Role    string `json:"role" binding:"required,oneof=owner editor viewer"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, models.Response{Code: 400, Message: err.Error()})
+		return
+	}
+
+	var pipeline models.Pipeline
+	if err := h.db.First(&pipeline, pipelineID).Error; err != nil {
+		c.JSON(http.StatusNotFound, models.Response{Code: 404, Message: "流水线不存在"})
+		return
+	}
+	var group models.DeployUserGroup
+	if err := h.db.First(&group, req.GroupID).Error; err != nil {
+		c.JSON(http.StatusNotFound, models.Response{Code: 404, Message: "用户组不存在"})
+		return
+	}
+
+	member := models.DeployPipelineMember{
+		PipelineID: uint(pipelineID),
+		GroupID:    &req.GroupID,
+		Role:       models.MemberRole(req.Role),
+	}
+	if err := h.db.Create(&member).Error; err != nil {
+		c.JSON(http.StatusConflict, models.Response{Code: 409, Message: "该组已被授权到此流水线"})
+		return
+	}
+
+	// 预加载关联
+	member.Group = &group
+	c.JSON(http.StatusOK, models.Response{Code: 200, Data: member, Message: "已授权"})
+}