feat(rbac): F3 前端 RBAC 按钮级控制

后端:
- 新增 GET /user/permissions 端点返回当前用户权限码
- Login 响应附带 permissions 数组
- collectUserPermissionCodes 用 raw SQL JOIN 避免 GORM many2many 表名问题
- admin 用户返回 ['*'] 通配符

前端:
- usePermission hook (hasPermission/hasAnyPermission/hasAllPermissions)
- <HasPermission> 组件 (permission/anyOf/allOf + fallback)
- zustand store 新增 permissions 字段
- Sidebar 菜单递归过滤 (42 菜单项全部标注 permission)
- ServerManager: 添加/导入/批量删除按钮按权限显隐
- ServerTableRow: 终端/编辑/文件/删除按权限显隐
- SystemUserTab: 新建/导入/编辑/删除按钮按权限显隐
- MainLayout: 页面刷新自动拉取权限
- Login: 登录时存储 permissions

验证:
- admin: permissions=['*'] 通配符
- viewer: 7 个只读权限 (dashboard:view/server:view/...)
- viewer 无 server:create/delete
- 10/10 回归测试通过
- npm run build 零错误

frontend/src/store/index.ts

@@ -19,9 +19,12 @@ interface UserState {
   token: string | null;
   isAuthenticated: boolean;
   theme?: string;
+  /** 当前用户权限码列表（RBAC 按钮级控制）；admin 为 ["*"]；null 表示未加载 */
+  permissions: string[] | null;
   setUser: (user: User | null) => void;
   setToken: (token: string | null) => void;
-  login: (user: User, token: string) => void;
+  setPermissions: (permissions: string[] | null) => void;
+  login: (user: User, token: string, permissions?: string[]) => void;
   logout: () => void;
 }
 
@@ -32,10 +35,12 @@ export const useUserStore = create<UserState>()(
       token: null as string | null,
       isAuthenticated: false,
       theme: 'ocean-deep',
+      permissions: null as string[] | null,
       setUser: (user) => set({ user }),
       setToken: (token) => set({ token }),
-      login: (user, token) => set({ user, token, isAuthenticated: true }),
-      logout: () => { localStorage.removeItem('token'); set({ user: null as User | null, token: null as string | null, isAuthenticated: false }); },
+      setPermissions: (permissions) => set({ permissions }),
+      login: (user, token, permissions) => set({ user, token, isAuthenticated: true, permissions: permissions ?? null }),
+      logout: () => { localStorage.removeItem('token'); set({ user: null as User | null, token: null as string | null, isAuthenticated: false, permissions: null }); },
     }),
     {
       name: 'user-storage',