feat: 实例权限组系统 — 完整CRUD + 实例/用户关联 + 前端管理页面

后端:
- InstanceGroup 模型 (name/db_type/permissions JSON/is_active)
- user_groups 关联表 (用户-权限组 M2M + 权限覆盖)
- Instance 模型增加 group_id FK
- User 模型增加 groups 关系
- API: CRUD + 实例关联 + 用户分配 + 权限组过滤
- 15 个新测试 (CRUD/关联/权限检查/参数校验) — 217/217 passing

前端:
- InstanceGroupPage: 左右布局(列表+详情)
- 权限配置: 5类17项权限勾选 (查询/DDL/工单/数据操作/管理)
- 实例关联/用户关联弹框
- 侧边栏增加权限组菜单 (数据源分组下)
- 路由 + 权限注册

backend/app/models/instance_group.py

@@ -0,0 +1,42 @@
+import json
+from sqlalchemy import Column, Integer, String, Text, Boolean, DateTime, ForeignKey, Table, func
+from sqlalchemy.orm import relationship
+
+from app.core.database import Base
+
+# 用户-权限组关联表
+user_groups = Table(
+    "user_groups",
+    Base.metadata,
+    Column("user_id", Integer, ForeignKey("users.id", ondelete="CASCADE"), primary_key=True),
+    Column("group_id", Integer, ForeignKey("instance_groups.id", ondelete="CASCADE"), primary_key=True),
+    Column("permissions", Text, nullable=True),  # JSON: 覆盖组默认权限
+)
+
+
+class InstanceGroup(Base):
+    __tablename__ = "instance_groups"
+
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    name = Column(String(100), nullable=False, unique=True)
+    description = Column(Text, nullable=True)
+    db_type = Column(String(20), nullable=False, default="all")  # mysql/redis/pg/mongo/all
+    permissions = Column(Text, nullable=True)  # JSON: ["query:select", ...]
+    is_active = Column(Boolean, default=True)
+    created_at = Column(DateTime, server_default=func.now())
+    updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now())
+
+    # 关系
+    instances = relationship("Instance", back_populates="group", lazy="selectin")
+    users = relationship("User", secondary=user_groups, back_populates="groups", lazy="selectin")
+
+    def get_permissions(self) -> list:
+        if self.permissions:
+            try:
+                return json.loads(self.permissions)
+            except (json.JSONDecodeError, TypeError):
+                return []
+        return []
+
+    def set_permissions(self, perms: list):
+        self.permissions = json.dumps(perms, ensure_ascii=False) if perms else None