feat: 角色权限体系改造 — developer可审批, auditor纯只读

角色权限矩阵:
- admin: 全部权限
- dba: 数据源管理+工单全流程+审批+执行
- developer: 查询+提交工单+审批(不能执行)
- auditor: 只读(审计日志+审核规则+审批流程查看)

后端改动:
- ticket.go: 修复GetCurrentUser返回值顺序bug(userID,username,role)
- ticket.go: CreateTicket拦截auditor提交工单
- ticket.go: ApproveTicket允许admin/dba/developer
- ticket.go: ExecuteTicket仅允许admin/dba
- router.go: query执行限制admin/dba/developer
- router.go: workflow写操作限制admin/dba
- router.go: audit-rules写操作限制admin/dba

前端改动:
- menu.ts: tickets去掉auditor, workflow加developer+auditor, audit-logs加auditor
- useAuth.tsx: routePermissionMap和actionPermissionMap同步更新
- TicketDetailPage: canApprove加developer角色

DB迁移: test123/test234从auditor→developer

backend/router/router.go

@@ -153,10 +153,14 @@ func Setup(r *gin.Engine) {
 		// Audit Logs
 		auth.GET("/audit-logs", handler.ListAuditLogs)
 
-		// Query execution
-		auth.POST("/query/execute", handler.ExecuteQuery)
-		auth.POST("/query", handler.ExecuteQuery)
-		auth.POST("/query/export", handler.ExportQueryCSV)
+		// Query execution (auditor excluded)
+		queryGroup := auth.Group("")
+		queryGroup.Use(middleware.RequireRole("admin", "dba", "developer"))
+		{
+			queryGroup.POST("/query/execute", handler.ExecuteQuery)
+			queryGroup.POST("/query", handler.ExecuteQuery)
+			queryGroup.POST("/query/export", handler.ExportQueryCSV)
+		}
 
 
 		// SQL Assistant
@@ -180,11 +184,15 @@ func Setup(r *gin.Engine) {
 		auth.POST("/mongo/:id/execute", handler.MongoExecute)
 		auth.POST("/mongo/:id/test-connection", handler.MongoTestConnection)
 
-		// Read-only resources
+		// Audit rules — read for all, write for admin/dba
 		auth.GET("/audit-rules", handler.ListAuditRules)
-		auth.POST("/audit-rules/seed/:dbType", handler.SeedAuditRules)
-		auth.POST("/audit-rules/:id/toggle", handler.ToggleAuditRule)
-		auth.PUT("/audit-rules/:id", handler.UpdateAuditRule)
+		ruleAdmin := auth.Group("")
+		ruleAdmin.Use(middleware.RequireRole("admin", "dba"))
+		{
+			ruleAdmin.POST("/audit-rules/seed/:dbType", handler.SeedAuditRules)
+			ruleAdmin.POST("/audit-rules/:id/toggle", handler.ToggleAuditRule)
+			ruleAdmin.PUT("/audit-rules/:id", handler.UpdateAuditRule)
+		}
 		auth.GET("/announcements", handler.ListAnnouncements)
 		auth.GET("/query-histories", handler.ListQueryHistories)
 		// Notifications CRUD (replaces old channels/templates endpoints)
@@ -195,11 +203,17 @@ func Setup(r *gin.Engine) {
 		auth.POST("/notifications/:id/test", handler.TestNotificationSend)
 		auth.GET("/workflows", handler.ListWorkflows)
 		auth.GET("/workflows/:id", handler.GetWorkflow)
-		auth.POST("/workflows", handler.CreateWorkflow)
-		auth.PUT("/workflows/:id", handler.UpdateWorkflow)
-		auth.DELETE("/workflows/:id", handler.DeleteWorkflow)
-		auth.POST("/workflows/:id/set-default", handler.SetDefaultWorkflow)
 		auth.POST("/workflows/:id/clone", handler.CloneWorkflow)
 
+		// Workflow management (admin/dba only)
+		wfAdmin := auth.Group("")
+		wfAdmin.Use(middleware.RequireRole("admin", "dba"))
+		{
+			wfAdmin.POST("/workflows", handler.CreateWorkflow)
+			wfAdmin.PUT("/workflows/:id", handler.UpdateWorkflow)
+			wfAdmin.DELETE("/workflows/:id", handler.DeleteWorkflow)
+			wfAdmin.POST("/workflows/:id/set-default", handler.SetDefaultWorkflow)
+		}
+
 	}
 }