feat: 角色权限体系改造 — developer可审批, auditor纯只读

角色权限矩阵:
- admin: 全部权限
- dba: 数据源管理+工单全流程+审批+执行
- developer: 查询+提交工单+审批(不能执行)
- auditor: 只读(审计日志+审核规则+审批流程查看)

后端改动:
- ticket.go: 修复GetCurrentUser返回值顺序bug(userID,username,role)
- ticket.go: CreateTicket拦截auditor提交工单
- ticket.go: ApproveTicket允许admin/dba/developer
- ticket.go: ExecuteTicket仅允许admin/dba
- router.go: query执行限制admin/dba/developer
- router.go: workflow写操作限制admin/dba
- router.go: audit-rules写操作限制admin/dba

前端改动:
- menu.ts: tickets去掉auditor, workflow加developer+auditor, audit-logs加auditor
- useAuth.tsx: routePermissionMap和actionPermissionMap同步更新
- TicketDetailPage: canApprove加developer角色

DB迁移: test123/test234从auditor→developer

backend/internal/handler/ticket.go

@@ -198,8 +198,14 @@ func GetTicket(c *gin.Context) {
 
 // POST /api/v1/tickets
 func CreateTicket(c *gin.Context) {
-	userID, _, _ := middleware.GetCurrentUser(c)
-	
+	userID, _, userRole := middleware.GetCurrentUser(c)
+
+	// auditor cannot create tickets
+	if userRole == "auditor" {
+		c.JSON(http.StatusForbidden, gin.H{"detail": "权限不足：审计员不能提交工单"})
+		return
+	}
+
 	var input struct {
 		Title          string  `json:"title" binding:"required"`
 		DBType         string  `json:"db_type" binding:"required"`
@@ -367,11 +373,11 @@ func CreateTicket(c *gin.Context) {
 // POST /api/v1/tickets/:id/approve
 func ApproveTicket(c *gin.Context) {
 	id := c.Param("id")
-	userID, userRole, _ := middleware.GetCurrentUser(c)
+	userID, _, userRole := middleware.GetCurrentUser(c)
 
-	// Role check: only admin/dba/auditor can approve
-	if userRole != "admin" && userRole != "dba" && userRole != "auditor" {
-		c.JSON(http.StatusForbidden, gin.H{"detail": "权限不足：审核操作需要管理员、DBA 或审核员角色"})
+	// Role check: admin/dba/developer can approve
+	if userRole != "admin" && userRole != "dba" && userRole != "developer" {
+		c.JSON(http.StatusForbidden, gin.H{"detail": "权限不足：审核操作需要管理员、DBA 或开发者角色"})
 		return
 	}
 
@@ -441,7 +447,7 @@ func ExecuteTicket(c *gin.Context) {
 	id := c.Param("id")
 
 	// Role check: only admin/dba can execute
-	_, userRole, _ := middleware.GetCurrentUser(c)
+	_, _, userRole := middleware.GetCurrentUser(c)
 	if userRole != "admin" && userRole != "dba" {
 		c.JSON(http.StatusForbidden, gin.H{"detail": "权限不足：执行操作需要管理员或 DBA 角色"})
 		return