feat(rbac): F3 前端 RBAC 按钮级控制

后端:
- 新增 GET /user/permissions 端点返回当前用户权限码
- Login 响应附带 permissions 数组
- collectUserPermissionCodes 用 raw SQL JOIN 避免 GORM many2many 表名问题
- admin 用户返回 ['*'] 通配符

前端:
- usePermission hook (hasPermission/hasAnyPermission/hasAllPermissions)
- <HasPermission> 组件 (permission/anyOf/allOf + fallback)
- zustand store 新增 permissions 字段
- Sidebar 菜单递归过滤 (42 菜单项全部标注 permission)
- ServerManager: 添加/导入/批量删除按钮按权限显隐
- ServerTableRow: 终端/编辑/文件/删除按权限显隐
- SystemUserTab: 新建/导入/编辑/删除按钮按权限显隐
- MainLayout: 页面刷新自动拉取权限
- Login: 登录时存储 permissions

验证:
- admin: permissions=['*'] 通配符
- viewer: 7 个只读权限 (dashboard:view/server:view/...)
- viewer 无 server:create/delete
- 10/10 回归测试通过
- npm run build 零错误

frontend/src/components/server/ServerManager.tsx

@@ -51,9 +51,11 @@ import { ExcelServerImport } from './ExcelServerImport';
 import { ServerForm, EMPTY_FORM, type ServerFormData } from './ServerForm';
 import { getTags } from './serverHelpers';
 import { ServerTableRow } from './ServerTableRow';
+import { usePermission } from '@/hooks/usePermission';
 
 export function ServerManager() {
   const confirm = useConfirm();
+  const { hasPermission } = usePermission();
   const [servers, setServers] = useState<any[]>([]);
   const [loading, setLoading] = useState(true);
   const [selectedServers, setSelectedServers] = useState<string[]>([]);
@@ -392,6 +394,7 @@ export function ServerManager() {
             <Download className="h-4 w-4 mr-2" />
             导出
           </Button>
+          {hasPermission('server:create') && (
           <DropdownMenu>
             <DropdownMenuTrigger asChild>
               <Button variant="outline" className="border-[var(--dg-border)] text-[var(--dg-text-secondary)] hover:text-[var(--dg-text-primary)] hover:bg-[var(--dg-bg-hover)]">
@@ -420,13 +423,16 @@ export function ServerManager() {
               </DropdownMenuItem>
             </DropdownMenuContent>
           </DropdownMenu>
-          <Button
-            className="bg-[var(--dg-blue)] hover:opacity-90 text-white"
-            onClick={openCreateForm}
-          >
-            <Plus className="h-4 w-4 mr-2" />
-            添加服务器
-          </Button>
+          )}
+          {hasPermission('server:create') && (
+            <Button
+              className="bg-[var(--dg-blue)] hover:opacity-90 text-white"
+              onClick={openCreateForm}
+            >
+              <Plus className="h-4 w-4 mr-2" />
+              添加服务器
+            </Button>
+          )}
         </div>
       </div>
 
@@ -464,6 +470,7 @@ export function ServerManager() {
             {selectedServers.length > 0 && (
               <div className="flex items-center gap-2">
                 <span className="text-sm text-[var(--dg-text-secondary)]">已选择 {selectedServers.length} 项</span>
+                {hasPermission('server:delete') && (
                 <Button
                   variant="outline"
                   size="sm"
@@ -473,6 +480,7 @@ export function ServerManager() {
                   <Trash2 className="h-4 w-4 mr-2" />
                   批量删除
                 </Button>
+                )}
               </div>
             )}
           </div>

frontend/src/components/server/ServerTableRow.tsx

@@ -14,6 +14,7 @@ import {
 import { TableCell, TableRow } from '@/components/ui/table';
 import { Edit, MoreHorizontal, Server as ServerIcon, Terminal, Trash2, Network, HardDrive, FolderOpen } from 'lucide-react';
 import { getStatusBadge, getTags, getUsageColor } from './serverHelpers';
+import { usePermission } from '@/hooks/usePermission';
 
 interface ServerTableRowProps {
   server: any;
@@ -34,6 +35,7 @@ export function ServerTableRow({
   onOpenFiles,
   onDelete,
 }: ServerTableRowProps) {
+  const { hasPermission } = usePermission();
   const cpuUsage = Number(server.cpu_usage || 0);
   const memoryUsage = Number(server.memory_usage || 0);
   const tags = getTags(server);
@@ -147,9 +149,12 @@ export function ServerTableRow({
       </TableCell>
       <TableCell className="text-right">
         <div className="flex items-center justify-end gap-1">
+          {hasPermission('server:webshell') && (
           <Button variant="ghost" size="icon" className="h-8 w-8 text-[var(--dg-text-secondary)] hover:text-[var(--dg-blue)]" onClick={() => onOpenTerminal(server)} title="终端登录">
             <Terminal className="h-4 w-4" />
           </Button>
+          )}
+          {(hasPermission('server:update') || hasPermission('server:delete') || hasPermission('server:webshell')) && (
           <DropdownMenu>
             <DropdownMenuTrigger asChild>
               <Button variant="ghost" size="icon" className="h-8 w-8 text-[var(--dg-text-secondary)] hover:text-[var(--dg-text-primary)]">
@@ -159,6 +164,7 @@ export function ServerTableRow({
             <DropdownMenuContent align="end" className="w-48 bg-[var(--dg-bg-tertiary)] border-[var(--dg-border)]">
               <DropdownMenuLabel className="text-[var(--dg-text-secondary)]">操作</DropdownMenuLabel>
               <DropdownMenuSeparator className="bg-[var(--dg-border)]" />
+              {hasPermission('server:update') && (
               <DropdownMenuItem
                 className="text-[var(--dg-text-secondary)] focus:bg-[var(--dg-bg-hover)] focus:text-[var(--dg-text-primary)] cursor-pointer"
                 onClick={() => onOpenEdit(server)}
@@ -166,6 +172,8 @@ export function ServerTableRow({
                 <Edit className="h-4 w-4 mr-2" />
                 编辑
               </DropdownMenuItem>
+              )}
+              {hasPermission('server:webshell') && (
               <DropdownMenuItem
                 className="text-[var(--dg-text-secondary)] focus:bg-[var(--dg-bg-hover)] focus:text-[var(--dg-text-primary)] cursor-pointer"
                 onClick={() => onOpenTerminal(server)}
@@ -173,6 +181,8 @@ export function ServerTableRow({
                 <Terminal className="h-4 w-4 mr-2" />
                 终端
               </DropdownMenuItem>
+              )}
+              {hasPermission('server:update') && (
               <DropdownMenuItem
                 className="text-[var(--dg-text-secondary)] focus:bg-[var(--dg-bg-hover)] focus:text-[var(--dg-text-primary)] cursor-pointer"
                 onClick={() => onOpenFiles?.(server)}
@@ -180,6 +190,9 @@ export function ServerTableRow({
                 <FolderOpen className="h-4 w-4 mr-2" />
                 文件
               </DropdownMenuItem>
+              )}
+              {hasPermission('server:delete') && (
+              <>
               <DropdownMenuSeparator className="bg-[var(--dg-border)]" />
               <DropdownMenuItem
                 className="text-red-400 focus:bg-[var(--dg-bg-hover)] focus:text-red-400 cursor-pointer"
@@ -188,8 +201,11 @@ export function ServerTableRow({
                 <Trash2 className="h-4 w-4 mr-2" />
                 删除
               </DropdownMenuItem>
+              </>
+              )}
             </DropdownMenuContent>
           </DropdownMenu>
+          )}
         </div>
       </TableCell>
     </TableRow>