feat(rbac): F3 前端 RBAC 按钮级控制

后端:
- 新增 GET /user/permissions 端点返回当前用户权限码
- Login 响应附带 permissions 数组
- collectUserPermissionCodes 用 raw SQL JOIN 避免 GORM many2many 表名问题
- admin 用户返回 ['*'] 通配符

前端:
- usePermission hook (hasPermission/hasAnyPermission/hasAllPermissions)
- <HasPermission> 组件 (permission/anyOf/allOf + fallback)
- zustand store 新增 permissions 字段
- Sidebar 菜单递归过滤 (42 菜单项全部标注 permission)
- ServerManager: 添加/导入/批量删除按钮按权限显隐
- ServerTableRow: 终端/编辑/文件/删除按权限显隐
- SystemUserTab: 新建/导入/编辑/删除按钮按权限显隐
- MainLayout: 页面刷新自动拉取权限
- Login: 登录时存储 permissions

验证:
- admin: permissions=['*'] 通配符
- viewer: 7 个只读权限 (dashboard:view/server:view/...)
- viewer 无 server:create/delete
- 10/10 回归测试通过
- npm run build 零错误

backend/router/routes.go

@@ -143,6 +143,7 @@ func Register(r *gin.Engine, db *gorm.DB, log *zap.Logger, cfg *config.Config, c
 	user := authorized.Group("/user")
 	{
 		user.GET("/profile", authHandler.GetProfile)
+		user.GET("/permissions", authHandler.GetMyPermissions)
 		user.PUT("/profile", authHandler.UpdateProfile)
 		user.POST("/change-password", authHandler.ChangePassword)
 		user.GET("/roles", authHandler.ListRoles)
@@ -680,6 +681,19 @@ func Register(r *gin.Engine, db *gorm.DB, log *zap.Logger, cfg *config.Config, c
 		approvals.POST("/processes/:id/reject", approvalHandler.RejectProcess)
 	}
 
+	// 审批流程配置（工作流定义）
+	workflowHandler := controller.NewWorkflowHandler(db)
+	workflows := authorized.Group("/approval-workflows")
+	{
+		workflows.GET("", workflowHandler.ListWorkflows)
+		workflows.POST("", workflowHandler.CreateWorkflow)
+		workflows.GET("/:id", workflowHandler.GetWorkflow)
+		workflows.PUT("/:id", workflowHandler.UpdateWorkflow)
+		workflows.DELETE("/:id", workflowHandler.DeleteWorkflow)
+		workflows.PUT("/:id/default", workflowHandler.SetDefaultWorkflow)
+		workflows.GET("/:id/steps", workflowHandler.GetWorkflowSteps)
+	}
+
 	// 导航路由
 	navHandler := controller.NewNavigationHandler(db)
 	navigations := authorized.Group("/navigations")