feat: 角色权限体系改造 — developer可审批, auditor纯只读

角色权限矩阵:
- admin: 全部权限
- dba: 数据源管理+工单全流程+审批+执行
- developer: 查询+提交工单+审批(不能执行)
- auditor: 只读(审计日志+审核规则+审批流程查看)

后端改动:
- ticket.go: 修复GetCurrentUser返回值顺序bug(userID,username,role)
- ticket.go: CreateTicket拦截auditor提交工单
- ticket.go: ApproveTicket允许admin/dba/developer
- ticket.go: ExecuteTicket仅允许admin/dba
- router.go: query执行限制admin/dba/developer
- router.go: workflow写操作限制admin/dba
- router.go: audit-rules写操作限制admin/dba

前端改动:
- menu.ts: tickets去掉auditor, workflow加developer+auditor, audit-logs加auditor
- useAuth.tsx: routePermissionMap和actionPermissionMap同步更新
- TicketDetailPage: canApprove加developer角色

DB迁移: test123/test234从auditor→developer

backend/internal/handler/ticket.go

@@ -198,8 +198,14 @@ func GetTicket(c *gin.Context) {
 
 // POST /api/v1/tickets
 func CreateTicket(c *gin.Context) {
-	userID, _, _ := middleware.GetCurrentUser(c)
-	
+	userID, _, userRole := middleware.GetCurrentUser(c)
+
+	// auditor cannot create tickets
+	if userRole == "auditor" {
+		c.JSON(http.StatusForbidden, gin.H{"detail": "权限不足：审计员不能提交工单"})
+		return
+	}
+
 	var input struct {
 		Title          string  `json:"title" binding:"required"`
 		DBType         string  `json:"db_type" binding:"required"`
@@ -367,11 +373,11 @@ func CreateTicket(c *gin.Context) {
 // POST /api/v1/tickets/:id/approve
 func ApproveTicket(c *gin.Context) {
 	id := c.Param("id")
-	userID, userRole, _ := middleware.GetCurrentUser(c)
+	userID, _, userRole := middleware.GetCurrentUser(c)
 
-	// Role check: only admin/dba/auditor can approve
-	if userRole != "admin" && userRole != "dba" && userRole != "auditor" {
-		c.JSON(http.StatusForbidden, gin.H{"detail": "权限不足：审核操作需要管理员、DBA 或审核员角色"})
+	// Role check: admin/dba/developer can approve
+	if userRole != "admin" && userRole != "dba" && userRole != "developer" {
+		c.JSON(http.StatusForbidden, gin.H{"detail": "权限不足：审核操作需要管理员、DBA 或开发者角色"})
 		return
 	}
 
@@ -441,7 +447,7 @@ func ExecuteTicket(c *gin.Context) {
 	id := c.Param("id")
 
 	// Role check: only admin/dba can execute
-	_, userRole, _ := middleware.GetCurrentUser(c)
+	_, _, userRole := middleware.GetCurrentUser(c)
 	if userRole != "admin" && userRole != "dba" {
 		c.JSON(http.StatusForbidden, gin.H{"detail": "权限不足：执行操作需要管理员或 DBA 角色"})
 		return

backend/router/router.go

@@ -153,10 +153,14 @@ func Setup(r *gin.Engine) {
 		// Audit Logs
 		auth.GET("/audit-logs", handler.ListAuditLogs)
 
-		// Query execution
-		auth.POST("/query/execute", handler.ExecuteQuery)
-		auth.POST("/query", handler.ExecuteQuery)
-		auth.POST("/query/export", handler.ExportQueryCSV)
+		// Query execution (auditor excluded)
+		queryGroup := auth.Group("")
+		queryGroup.Use(middleware.RequireRole("admin", "dba", "developer"))
+		{
+			queryGroup.POST("/query/execute", handler.ExecuteQuery)
+			queryGroup.POST("/query", handler.ExecuteQuery)
+			queryGroup.POST("/query/export", handler.ExportQueryCSV)
+		}
 
 
 		// SQL Assistant
@@ -180,11 +184,15 @@ func Setup(r *gin.Engine) {
 		auth.POST("/mongo/:id/execute", handler.MongoExecute)
 		auth.POST("/mongo/:id/test-connection", handler.MongoTestConnection)
 
-		// Read-only resources
+		// Audit rules — read for all, write for admin/dba
 		auth.GET("/audit-rules", handler.ListAuditRules)
-		auth.POST("/audit-rules/seed/:dbType", handler.SeedAuditRules)
-		auth.POST("/audit-rules/:id/toggle", handler.ToggleAuditRule)
-		auth.PUT("/audit-rules/:id", handler.UpdateAuditRule)
+		ruleAdmin := auth.Group("")
+		ruleAdmin.Use(middleware.RequireRole("admin", "dba"))
+		{
+			ruleAdmin.POST("/audit-rules/seed/:dbType", handler.SeedAuditRules)
+			ruleAdmin.POST("/audit-rules/:id/toggle", handler.ToggleAuditRule)
+			ruleAdmin.PUT("/audit-rules/:id", handler.UpdateAuditRule)
+		}
 		auth.GET("/announcements", handler.ListAnnouncements)
 		auth.GET("/query-histories", handler.ListQueryHistories)
 		// Notifications CRUD (replaces old channels/templates endpoints)
@@ -195,11 +203,17 @@ func Setup(r *gin.Engine) {
 		auth.POST("/notifications/:id/test", handler.TestNotificationSend)
 		auth.GET("/workflows", handler.ListWorkflows)
 		auth.GET("/workflows/:id", handler.GetWorkflow)
-		auth.POST("/workflows", handler.CreateWorkflow)
-		auth.PUT("/workflows/:id", handler.UpdateWorkflow)
-		auth.DELETE("/workflows/:id", handler.DeleteWorkflow)
-		auth.POST("/workflows/:id/set-default", handler.SetDefaultWorkflow)
 		auth.POST("/workflows/:id/clone", handler.CloneWorkflow)
 
+		// Workflow management (admin/dba only)
+		wfAdmin := auth.Group("")
+		wfAdmin.Use(middleware.RequireRole("admin", "dba"))
+		{
+			wfAdmin.POST("/workflows", handler.CreateWorkflow)
+			wfAdmin.PUT("/workflows/:id", handler.UpdateWorkflow)
+			wfAdmin.DELETE("/workflows/:id", handler.DeleteWorkflow)
+			wfAdmin.POST("/workflows/:id/set-default", handler.SetDefaultWorkflow)
+		}
+
 	}
 }