feat: 发布权限 RBAC + PipelineEditor 修复 + 菜单优化

- 新增 DeployRBAC 页面: Jenkins-style Item Role 权限管理
  - 正则匹配流水线 code，实时命中预览
  - 内置用户分配面板，无需跳转系统管理
  - 支持创建/编辑/删除/启用禁用 Item Role
- 修复 PipelineEditor 成员管理 http 双解包 bug
- 修复 PipelineManager 前端 code 路由迁移(delete/trigger/stop/loadRuns)
- 新增批量删除流水线运行记录 API
- Sidebar: 应用发布下新增「发布权限」, 仓库认证→发布配置, 移除用户组
- 恢复系统管理菜单(不受发布权限改动影响)
- 后端 ItemRole CRUD handler + 正则匹配中间件已就绪

frontend/src/services/api.ts

@@ -409,6 +409,27 @@ export const pipelineApi = {
   getRuns: async (id: number | string) => {
     return http.get(`/pipelines/${id}/runs`);
   },
+  // 运行控制
+  stopRun: async (pipelineId: number | string, runId: number | string) => {
+    return http.post(`/pipelines/${pipelineId}/runs/${runId}/stop`);
+  },
+  getRunLog: async (pipelineId: number | string, runId: number | string) => {
+    return http.get(`/pipelines/${pipelineId}/runs/${runId}/log`);
+  },
+  // 成员管理
+  getMembers: async (pipelineId: number | string) => {
+    return http.get(`/pipelines/${pipelineId}/members`);
+  },
+  addMember: async (pipelineId: number | string, data: { username: string; role: string }) => {
+    return http.post(`/pipelines/${pipelineId}/members`, data);
+  },
+  removeMember: async (pipelineId: number | string, memberId: number | string) => {
+    return http.delete(`/pipelines/${pipelineId}/members/${memberId}`);
+  },
+  // 组授权
+  assignGroup: async (pipelineId: number | string, data: { group_id: number; role: string }) => {
+    return http.post(`/pipelines/${pipelineId}/groups`, data);
+  },
 };
 
 // ==================== 应用发布 API ====================
@@ -722,6 +743,43 @@ export const terminalSessionApi = {
   },
 };
 
+// ==================== 发布系统 API（仓库/镜像仓库认证） ====================
+export const deployApi = {
+  // Git 仓库认证
+  getRepos: () => http.get<ListResponse>('/deploy/repos'),
+  getRepo: (id: number | string) => http.get(`/deploy/repos/${id}`),
+  createRepo: (data: any) => http.post('/deploy/repos', data),
+  updateRepo: (id: number | string, data: any) => http.put(`/deploy/repos/${id}`, data),
+  deleteRepo: (id: number | string) => http.delete(`/deploy/repos/${id}`),
+  // 镜像仓库认证
+  getRegistries: () => http.get<ListResponse>('/deploy/registries'),
+  getRegistry: (id: number | string) => http.get(`/deploy/registries/${id}`),
+  createRegistry: (data: any) => http.post('/deploy/registries', data),
+  updateRegistry: (id: number | string, data: any) => http.put(`/deploy/registries/${id}`, data),
+  deleteRegistry: (id: number | string) => http.delete(`/deploy/registries/${id}`),
+  // 环境管理
+  getEnvironments: () => http.get<ListResponse>('/deploy/environments'),
+  createEnvironment: (data: any) => http.post('/deploy/environments', data),
+  updateEnvironment: (id: number | string, data: any) => http.put(`/deploy/environments/${id}`, data),
+  deleteEnvironment: (id: number | string) => http.delete(`/deploy/environments/${id}`),
+  // Item Role 权限管理 (Jenkins Role Strategy 风格）
+  getItemRoles: () => http.get<ListResponse>('/admin/item-roles'),
+  createItemRole: (data: any) => http.post('/admin/item-roles', data),
+  updateItemRole: (id: number | string, data: any) => http.put(`/admin/item-roles/${id}`, data),
+  deleteItemRole: (id: number | string) => http.delete(`/admin/item-roles/${id}`),
+  getUserItemRoles: (userId: number | string) => http.get(`/admin/users/${userId}/item-roles`),
+  assignItemRole: (userId: number | string, data: { user_id: number; item_role_id: number }) => http.post(`/admin/users/${userId}/item-roles`, data),
+  removeItemRole: (userId: number | string, roleId: number | string) => http.delete(`/admin/users/${userId}/item-roles/${roleId}`),
+  // 用户组管理
+  getGroups: () => http.get<ListResponse>('/deploy/groups'),
+  createGroup: (data: any) => http.post('/deploy/groups', data),
+  updateGroup: (id: number | string, data: any) => http.put(`/deploy/groups/${id}`, data),
+  deleteGroup: (id: number | string) => http.delete(`/deploy/groups/${id}`),
+  getGroupMembers: (id: number | string) => http.get(`/deploy/groups/${id}/members`),
+  addGroupMember: (id: number | string, data: { username: string }) => http.post(`/deploy/groups/${id}/members`, data),
+  removeGroupMember: (id: number | string, memberId: number | string) => http.delete(`/deploy/groups/${id}/members/${memberId}`),
+};
+
 // ==================== Ansible 自动化 API ====================
 export const ansibleApi = {
   // Playbook 管理