refactor: 权限组从一组一类型改为一组同时包含readonly+write实例

- 新增 instance_group_members 中间表关联权限组和实例
- InstanceGroup 模型移除旧的 instances relationship，改为通过中间表查询
- Instance 模型保留 group_id FK（兼容）但移除 group relationship
- Schema 新增 readonly_instance_ids / write_instance_ids 字段
- InstanceGroupResponse 改为 readonly_instance_count + write_instance_count
- InstanceGroupDetailResponse 返回 readonly_instances + write_instances
- InstanceAssignRequest 新增 access_type 参数
- API create/update 支持同步写入 instance_group_members
- role_permissions 服务更新为使用中间表查询
- 新增迁移 SQL 并应用到 sqlite3.db
- 测试全部通过 (20/20)

backend/app/schemas/instance_group.py

@@ -7,11 +7,6 @@ class InstanceGroupCreate(BaseModel):
     name: str = Field(..., min_length=1, max_length=100)
     description: Optional[str] = None
     db_type: str = Field(default="all", pattern=r"^(mysql|redis|pg|mongo|all)$")
-    access_type: str = Field(
-        default="readonly",
-        pattern=r"^(readonly|write)$",
-        description="权限组类型: readonly(只读查看) / write(写入变更)",
-    )
     allowed_databases: Optional[List[str]] = Field(
         default=None,
         description="允许访问的数据库名列表，为空表示关联实例的所有库",
@@ -19,17 +14,15 @@ class InstanceGroupCreate(BaseModel):
     # Legacy field kept for backward compatibility
     permissions: Optional[List[str]] = None
     is_active: bool = True
+    # New: instance ids by access_type
+    readonly_instance_ids: List[int] = Field(default_factory=list)
+    write_instance_ids: List[int] = Field(default_factory=list)
 
 
 class InstanceGroupUpdate(BaseModel):
     name: Optional[str] = Field(default=None, min_length=1, max_length=100)
     description: Optional[str] = None
     db_type: Optional[str] = Field(default=None, pattern=r"^(mysql|redis|pg|mongo|all)$")
-    access_type: Optional[str] = Field(
-        default=None,
-        pattern=r"^(readonly|write)$",
-        description="权限组类型: readonly(只读查看) / write(写入变更)",
-    )
     allowed_databases: Optional[List[str]] = Field(
         default=None,
         description="允许访问的数据库名列表，为空表示关联实例的所有库",
@@ -37,6 +30,9 @@ class InstanceGroupUpdate(BaseModel):
     # Legacy field kept for backward compatibility
     permissions: Optional[List[str]] = None
     is_active: Optional[bool] = None
+    # New: instance ids by access_type
+    readonly_instance_ids: Optional[List[int]] = None
+    write_instance_ids: Optional[List[int]] = None
 
 
 class InstanceGroupResponse(BaseModel):
@@ -47,24 +43,30 @@ class InstanceGroupResponse(BaseModel):
     # Legacy field
     permissions: Optional[List[str]] = None
     # New fields
-    access_type: Optional[str] = None
     allowed_databases: Optional[List[str]] = None
     is_active: bool
     created_at: Optional[datetime] = None
     updated_at: Optional[datetime] = None
-    instance_count: int = 0
+    readonly_instance_count: int = 0
+    write_instance_count: int = 0
     user_count: int = 0
 
     model_config = ConfigDict(from_attributes=True)
 
 
 class InstanceGroupDetailResponse(InstanceGroupResponse):
-    instances: List[dict] = []
+    readonly_instances: List[dict] = []
+    write_instances: List[dict] = []
     users: List[dict] = []
 
 
 class InstanceAssignRequest(BaseModel):
     instance_ids: List[int] = Field(..., min_length=1)
+    access_type: str = Field(default="readonly", pattern=r"^(readonly|write)$")
+
+
+class InstanceRemoveRequest(BaseModel):
+    instance_ids: List[int] = Field(..., min_length=1)
 
 
 class UserAssignRequest(BaseModel):