refactor: 权限组从一组一类型改为一组同时包含readonly+write实例

- 新增 instance_group_members 中间表关联权限组和实例
- InstanceGroup 模型移除旧的 instances relationship，改为通过中间表查询
- Instance 模型保留 group_id FK（兼容）但移除 group relationship
- Schema 新增 readonly_instance_ids / write_instance_ids 字段
- InstanceGroupResponse 改为 readonly_instance_count + write_instance_count
- InstanceGroupDetailResponse 返回 readonly_instances + write_instances
- InstanceAssignRequest 新增 access_type 参数
- API create/update 支持同步写入 instance_group_members
- role_permissions 服务更新为使用中间表查询
- 新增迁移 SQL 并应用到 sqlite3.db
- 测试全部通过 (20/20)

backend/app/models/instance.py

@@ -26,12 +26,11 @@ class Instance(Base):
     excluded_databases = Column(Text, nullable=True)  # JSON: ["sys", "information_schema", ...]
     mask_fields = Column(Text, nullable=True)  # JSON: [{table, field, rule}]
 
-    # 权限组关联
+    # 权限组关联 (legacy FK, kept for compat)
     group_id = Column(Integer, ForeignKey("instance_groups.id", ondelete="SET NULL"), nullable=True)
 
     created_at = Column(DateTime, server_default=func.now())
     updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now())
 
-    # 关系
-    group = relationship("InstanceGroup", back_populates="instances")
+    # 关系 — legacy group relationship removed; use instance_group_members instead
     workflow_def = relationship("WorkflowDefinition")