feat(rbac): F3 前端 RBAC 按钮级控制

后端:
- 新增 GET /user/permissions 端点返回当前用户权限码
- Login 响应附带 permissions 数组
- collectUserPermissionCodes 用 raw SQL JOIN 避免 GORM many2many 表名问题
- admin 用户返回 ['*'] 通配符

前端:
- usePermission hook (hasPermission/hasAnyPermission/hasAllPermissions)
- <HasPermission> 组件 (permission/anyOf/allOf + fallback)
- zustand store 新增 permissions 字段
- Sidebar 菜单递归过滤 (42 菜单项全部标注 permission)
- ServerManager: 添加/导入/批量删除按钮按权限显隐
- ServerTableRow: 终端/编辑/文件/删除按权限显隐
- SystemUserTab: 新建/导入/编辑/删除按钮按权限显隐
- MainLayout: 页面刷新自动拉取权限
- Login: 登录时存储 permissions

验证:
- admin: permissions=['*'] 通配符
- viewer: 7 个只读权限 (dashboard:view/server:view/...)
- viewer 无 server:create/delete
- 10/10 回归测试通过
- npm run build 零错误

frontend/src/components/system/SystemUserTab.tsx

@@ -25,6 +25,7 @@ import { UserFormDialog, type UserFormData } from './UserFormDialog';
 import { UserDetailDialog } from './UserDetailDialog';
 import { CsvImportDialog } from './CsvImportDialog';
 import { LdapImportDialog } from './LdapImportDialog';
+import { usePermission } from '@/hooks/usePermission';
 
 interface SystemUserTabProps {
   // Search
@@ -108,6 +109,7 @@ export function SystemUserTab({
   handleLdapImport,
   setLdapUsers,
 }: SystemUserTabProps) {
+  const { hasPermission } = usePermission();
   return (
     <>
       {/* Filters */}
@@ -122,18 +124,24 @@ export function SystemUserTab({
           />
         </div>
         <div className="flex items-center gap-2">
+          {hasPermission('system:user') && (
           <Button variant="outline" className="border-slate-700 text-slate-300 hover:text-slate-100 hover:bg-slate-800" onClick={() => setImportDialogOpen('csv')}>
             <Upload className="h-4 w-4 mr-2" />
             批量导入
           </Button>
+          )}
+          {hasPermission('system:user') && (
           <Button variant="outline" className="border-slate-700 text-slate-300 hover:text-slate-100 hover:bg-slate-800" onClick={() => setImportDialogOpen('ldap')}>
             <Network className="h-4 w-4 mr-2" />
             LDAP 导入
           </Button>
+          )}
+          {hasPermission('system:user') && (
           <Button className="bg-blue-600 hover:bg-blue-700 text-white" onClick={openCreate}>
             <Plus className="h-4 w-4 mr-2" />
             新建用户
           </Button>
+          )}
         </div>
       </div>
 
@@ -232,6 +240,7 @@ export function SystemUserTab({
                           >
                             <Eye className="h-4 w-4" />
                           </Button>
+                          {hasPermission('system:user') && (
                           <Button
                             variant="ghost"
                             size="icon"
@@ -240,6 +249,8 @@ export function SystemUserTab({
                           >
                             <Edit className="h-4 w-4" />
                           </Button>
+                          )}
+                          {hasPermission('system:user') && (
                           <Button
                             variant="ghost"
                             size="icon"
@@ -248,6 +259,7 @@ export function SystemUserTab({
                           >
                             <Trash2 className="h-4 w-4" />
                           </Button>
+                          )}
                         </div>
                       </TableCell>
                     </TableRow>