feat: 实例权限组系统 — 完整CRUD + 实例/用户关联 + 前端管理页面

后端:
- InstanceGroup 模型 (name/db_type/permissions JSON/is_active)
- user_groups 关联表 (用户-权限组 M2M + 权限覆盖)
- Instance 模型增加 group_id FK
- User 模型增加 groups 关系
- API: CRUD + 实例关联 + 用户分配 + 权限组过滤
- 15 个新测试 (CRUD/关联/权限检查/参数校验) — 217/217 passing

前端:
- InstanceGroupPage: 左右布局(列表+详情)
- 权限配置: 5类17项权限勾选 (查询/DDL/工单/数据操作/管理)
- 实例关联/用户关联弹框
- 侧边栏增加权限组菜单 (数据源分组下)
- 路由 + 权限注册

frontend/src/api/instanceGroup.ts

@@ -0,0 +1,33 @@
+import request from './request';
+
+export interface InstanceGroup {
+  id: number;
+  name: string;
+  description?: string;
+  db_type: string;
+  permissions?: string[];
+  is_active: boolean;
+  created_at?: string;
+  updated_at?: string;
+  instance_count?: number;
+  user_count?: number;
+  instances?: { id: number; name: string; db_type: string; host: string; port: number; env: string; status: string }[];
+  users?: { id: number; username: string; display_name: string; role: string }[];
+}
+
+export const instanceGroupApi = {
+  list: (params?: any) => request.get<any, InstanceGroup[]>('/instance-groups', { params }),
+  get: (id: number) => request.get<any, InstanceGroup>(`/instance-groups/${id}`),
+  create: (data: any) => request.post<any, InstanceGroup>('/instance-groups', data),
+  update: (id: number, data: any) => request.put<any, InstanceGroup>(`/instance-groups/${id}`, data),
+  delete: (id: number) => request.delete(`/instance-groups/${id}`),
+  assignInstances: (groupId: number, instanceIds: number[]) =>
+    request.post(`/instance-groups/${groupId}/instances`, { instance_ids: instanceIds }),
+  removeInstance: (groupId: number, instanceId: number) =>
+    request.delete(`/instance-groups/${groupId}/instances/${instanceId}`),
+  listUsers: (groupId: number) => request.get<any, any[]>(`/instance-groups/${groupId}/users`),
+  assignUsers: (groupId: number, userIds: number[], permissions?: string[]) =>
+    request.post(`/instance-groups/${groupId}/users`, { user_ids: userIds, permissions }),
+  updateUserGroups: (userId: number, groupIds: number[]) =>
+    request.put(`/instance-groups/users/${userId}/groups`, { group_ids: groupIds }),
+};