feat(rbac): F3 前端 RBAC 按钮级控制

后端:
- 新增 GET /user/permissions 端点返回当前用户权限码
- Login 响应附带 permissions 数组
- collectUserPermissionCodes 用 raw SQL JOIN 避免 GORM many2many 表名问题
- admin 用户返回 ['*'] 通配符

前端:
- usePermission hook (hasPermission/hasAnyPermission/hasAllPermissions)
- <HasPermission> 组件 (permission/anyOf/allOf + fallback)
- zustand store 新增 permissions 字段
- Sidebar 菜单递归过滤 (42 菜单项全部标注 permission)
- ServerManager: 添加/导入/批量删除按钮按权限显隐
- ServerTableRow: 终端/编辑/文件/删除按权限显隐
- SystemUserTab: 新建/导入/编辑/删除按钮按权限显隐
- MainLayout: 页面刷新自动拉取权限
- Login: 登录时存储 permissions

验证:
- admin: permissions=['*'] 通配符
- viewer: 7 个只读权限 (dashboard:view/server:view/...)
- viewer 无 server:create/delete
- 10/10 回归测试通过
- npm run build 零错误

backend/model/approval.go

@@ -57,6 +57,7 @@ type ApprovalStep struct {
 	ID        uint           `gorm:"primarykey" json:"id"`
 	ProcessID uint           `json:"process_id"`
 	Step      int            `json:"step"`
+	StepType  string         `gorm:"size:32;default:audit" json:"step_type"` // audit, execute
 	Approver  uint           `json:"approver"`
 	Status    string         `gorm:"size:32;default:pending" json:"status"` // pending, approved, rejected
 	Comment   string         `gorm:"size:500" json:"comment"`

backend/model/approval_workflow.go

@@ -0,0 +1,68 @@
+package model
+
+import "time"
+
+// ApprovalWorkflow 审批流程定义
+type ApprovalWorkflow struct {
+	ID          uint      `gorm:"primarykey" json:"id"`
+	Name        string    `gorm:"size:128;not null" json:"name"`
+	Description string    `gorm:"size:500" json:"description"`
+	Category    string    `gorm:"size:32;default:resource" json:"category"` // resource, app, permission
+	IsDefault   bool      `gorm:"default:false" json:"is_default"`
+	IsActive    bool      `gorm:"default:true" json:"is_active"`
+	CreatedAt   time.Time `json:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at"`
+
+	Steps []ApprovalWorkflowStep `gorm:"foreignKey:WorkflowID" json:"steps,omitempty"`
+}
+
+func (ApprovalWorkflow) TableName() string {
+	return "sys_approval_workflows"
+}
+
+// ApprovalWorkflowStep 审批流程步骤
+type ApprovalWorkflowStep struct {
+	ID          uint      `gorm:"primarykey" json:"id"`
+	WorkflowID  uint      `json:"workflow_id"`
+	StepNumber  int       `gorm:"not null" json:"step_number"`
+	Name        string    `gorm:"size:128;not null" json:"name"`
+	StepType    string    `gorm:"size:32;not null" json:"step_type"` // submit, audit, execute
+	ApproverIDs string    `gorm:"type:text" json:"approver_ids"`     // JSON array of user IDs
+	IsRequired  bool      `gorm:"default:true" json:"is_required"`
+	TimeoutHours int      `gorm:"default:24" json:"timeout_hours"`
+	AutoApprove bool      `gorm:"default:false" json:"auto_approve_on_timeout"`
+	CreatedAt   time.Time `json:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at"`
+}
+
+func (ApprovalWorkflowStep) TableName() string {
+	return "sys_approval_workflow_steps"
+}
+
+// CreateWorkflowRequest 创建审批流程请求
+type CreateWorkflowRequest struct {
+	Name        string                   `json:"name" binding:"required"`
+	Description string                   `json:"description"`
+	Category    string                   `json:"category"`
+	Steps       []CreateWorkflowStepReq  `json:"steps"`
+}
+
+type CreateWorkflowStepReq struct {
+	StepNumber       int    `json:"step_number"`
+	Name             string `json:"name" binding:"required"`
+	StepType         string `json:"step_type" binding:"required,oneof=submit audit execute"`
+	ApproverIDs      string `json:"approver_ids"`
+	IsRequired       bool   `json:"is_required"`
+	TimeoutHours     int    `json:"timeout_hours"`
+	AutoApproveTimeout bool `json:"auto_approve_on_timeout"`
+}
+
+// UpdateWorkflowRequest 更新审批流程请求
+type UpdateWorkflowRequest struct {
+	Name        *string                  `json:"name,omitempty"`
+	Description *string                  `json:"description,omitempty"`
+	Category    *string                  `json:"category,omitempty"`
+	IsActive    *bool                    `json:"is_active,omitempty"`
+	IsDefault   *bool                    `json:"is_default,omitempty"`
+	Steps       []CreateWorkflowStepReq  `json:"steps,omitempty"`
+}

backend/model/user.go

@@ -22,7 +22,7 @@ type User struct {
 	UpdatedAt  time.Time      `json:"updated_at"`
 
 	// 关联
-	Roles []Role `gorm:"many2many:user_roles;" json:"roles,omitempty"`
+	Roles []Role `gorm:"many2many:iam_user_roles;" json:"roles,omitempty"`
 }
 
 // TableName 表名
@@ -37,6 +37,7 @@ type Role struct {
 	Code        string         `gorm:"size:64;uniqueIndex;not null" json:"code"`
 	Description string         `gorm:"size:255" json:"description"`
 	Status      int            `gorm:"default:1" json:"status"`
+	IsSystem    bool           `gorm:"default:false" json:"is_system"` // 系统默认角色，禁止删除
 	CreatedAt   time.Time      `json:"created_at"`
 	UpdatedAt   time.Time      `json:"updated_at"`