feat: 发布权限 RBAC + PipelineEditor 修复 + 菜单优化

- 新增 DeployRBAC 页面: Jenkins-style Item Role 权限管理
  - 正则匹配流水线 code，实时命中预览
  - 内置用户分配面板，无需跳转系统管理
  - 支持创建/编辑/删除/启用禁用 Item Role
- 修复 PipelineEditor 成员管理 http 双解包 bug
- 修复 PipelineManager 前端 code 路由迁移(delete/trigger/stop/loadRuns)
- 新增批量删除流水线运行记录 API
- Sidebar: 应用发布下新增「发布权限」, 仓库认证→发布配置, 移除用户组
- 恢复系统管理菜单(不受发布权限改动影响)
- 后端 ItemRole CRUD handler + 正则匹配中间件已就绪

backend/internal/models/user.go

@@ -69,6 +69,40 @@ func (Permission) TableName() string {
 	return "iam_permissions"
 }
 
+// ItemRole Jenkins-style Item Role — regex pipeline code matching
+type ItemRole struct {
+	ID          uint      `gorm:"primarykey" json:"id"`
+	Name        string    `gorm:"size:64;not null" json:"name"`
+	Code        string    `gorm:"size:64;uniqueIndex;not null" json:"code"`
+	Pattern     string    `gorm:"size:255;not null;comment:正则表达式匹配流水线code" json:"pattern"`
+	Role        string    `gorm:"size:16;default:'editor';comment:角色owner/editor/viewer" json:"role"`
+	Description string    `gorm:"size:255" json:"description"`
+	Status      int       `gorm:"default:1;comment:0禁用1启用" json:"status"`
+	CreatedAt   time.Time `json:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at"`
+}
+
+// TableName 表名
+func (ItemRole) TableName() string {
+	return "iam_item_roles"
+}
+
+// UserItemRole user ↔ item_role association
+type UserItemRole struct {
+	ID         uint      `gorm:"primarykey" json:"id"`
+	UserID     uint      `gorm:"uniqueIndex:idx_user_item_role;not null" json:"user_id"`
+	ItemRoleID uint      `gorm:"uniqueIndex:idx_user_item_role;not null" json:"item_role_id"`
+	CreatedAt  time.Time `json:"created_at"`
+
+	User     *User     `json:"user,omitempty" gorm:"foreignKey:UserID"`
+	ItemRole *ItemRole `json:"item_role,omitempty" gorm:"foreignKey:ItemRoleID"`
+}
+
+// TableName 表名
+func (UserItemRole) TableName() string {
+	return "iam_user_item_roles"
+}
+
 // LoginRequest 登录请求
 type LoginRequest struct {
 	Username string `json:"username" binding:"required"`
@@ -111,11 +145,36 @@ type CreateRoleRequest struct {
 
 // UpdateRoleRequest 更新角色请求 // Logan.Li
 type UpdateRoleRequest struct {
-	Name          string `json:"name" binding:"omitempty,min=1,max=64"`
-	Code          string `json:"code" binding:"omitempty,min=1,max=64"`
+	Name          string  `json:"name" binding:"omitempty,min=1,max=64"`
+	Code          string  `json:"code" binding:"omitempty,min=1,max=64"`
 	Description   *string `json:"description"`
-	Status        *int   `json:"status"`
-	PermissionIDs []uint `json:"permission_ids"`
+	Status        *int    `json:"status"`
+	PermissionIDs []uint  `json:"permission_ids"`
+}
+
+// CreateItemRoleRequest 创建Item Role请求
+type CreateItemRoleRequest struct {
+	Name        string `json:"name" binding:"required,min=1,max=64"`
+	Code        string `json:"code" binding:"required,min=1,max=64"`
+	Pattern     string `json:"pattern" binding:"required,max=255"`
+	Role        string `json:"role" binding:"oneof=owner editor viewer"`
+	Description string `json:"description"`
+}
+
+// UpdateItemRoleRequest 更新Item Role请求
+type UpdateItemRoleRequest struct {
+	Name        string `json:"name" binding:"omitempty,min=1,max=64"`
+	Code        string `json:"code" binding:"omitempty,min=1,max=64"`
+	Pattern     string `json:"pattern" binding:"omitempty,max=255"`
+	Role        string `json:"role" binding:"omitempty,oneof=owner editor viewer"`
+	Description string `json:"description"`
+	Status      *int   `json:"status"`
+}
+
+// AssignItemRoleRequest 分配Item Role给用户
+type AssignItemRoleRequest struct {
+	UserID     uint `json:"user_id" binding:"required"`
+	ItemRoleID uint `json:"item_role_id" binding:"required"`
 }
 
 // ChangePasswordRequest 修改密码请求