feat: 角色权限体系改造 — developer可审批, auditor纯只读

角色权限矩阵:
- admin: 全部权限
- dba: 数据源管理+工单全流程+审批+执行
- developer: 查询+提交工单+审批(不能执行)
- auditor: 只读(审计日志+审核规则+审批流程查看)

后端改动:
- ticket.go: 修复GetCurrentUser返回值顺序bug(userID,username,role)
- ticket.go: CreateTicket拦截auditor提交工单
- ticket.go: ApproveTicket允许admin/dba/developer
- ticket.go: ExecuteTicket仅允许admin/dba
- router.go: query执行限制admin/dba/developer
- router.go: workflow写操作限制admin/dba
- router.go: audit-rules写操作限制admin/dba

前端改动:
- menu.ts: tickets去掉auditor, workflow加developer+auditor, audit-logs加auditor
- useAuth.tsx: routePermissionMap和actionPermissionMap同步更新
- TicketDetailPage: canApprove加developer角色

DB迁移: test123/test234从auditor→developer

frontend/src/constants/menu.ts

@@ -8,7 +8,7 @@ export const menuItems = [
   // 工作台 — 日常操作
   { id: 'dashboard', label: '仪表盘', icon: 'LayoutDashboard', section: 'workspace', roles: ['admin', 'dba', 'developer', 'auditor'], permission: 'dashboard.view' },
   { id: 'queries', label: '查询数据', icon: 'Code2', section: 'workspace', roles: ['admin', 'dba', 'developer'], permission: 'queries.execute' },
-  { id: 'tickets', label: '数据变更', icon: 'FileEdit', section: 'workspace', roles: ['admin', 'dba', 'developer', 'auditor'], permission: 'tickets.manage' },
+  { id: 'tickets', label: '数据变更', icon: 'FileEdit', section: 'workspace', roles: ['admin', 'dba', 'developer'], permission: 'tickets.manage' },
 
   // 管理 — 数据源 + 权限
   { id: 'instances', label: '数据源', icon: 'Database', section: 'admin', roles: ['admin', 'dba'], permission: 'instances.manage' },
@@ -17,8 +17,8 @@ export const menuItems = [
   { id: 'instance-groups', label: '权限组', icon: 'FolderLock', section: 'admin', roles: ['admin'], permission: 'instance-groups.manage' },
 
   // 系统
-  { id: 'workflow', label: '审批流程', icon: 'GitBranch', section: 'system', roles: ['admin', 'dba'], permission: 'workflow.manage' },
-  { id: 'audit-logs', label: '审计日志', icon: 'ScrollText', section: 'system', roles: ['admin', 'dba'], permission: 'audit-logs.view' },
+  { id: 'workflow', label: '审批流程', icon: 'GitBranch', section: 'system', roles: ['admin', 'dba', 'developer', 'auditor'], permission: 'workflow.manage' },
+  { id: 'audit-logs', label: '审计日志', icon: 'ScrollText', section: 'system', roles: ['admin', 'dba', 'auditor'], permission: 'audit-logs.view' },
   { id: 'auto-task', label: '自动任务', icon: 'Timer', section: 'system', roles: ['admin'], permission: 'auto-task.manage' },
   { id: 'settings', label: '系统设置', icon: 'Settings', section: 'system', roles: ['admin'], permission: 'settings.manage' },
 ];

frontend/src/hooks/useAuth.tsx

@@ -114,19 +114,19 @@ const routePermissionMap: Record<string, UserRole[]> = {
   instances: ['admin', 'dba'],
   'instance-groups': ['admin'],
   'data-dictionary': ['admin', 'dba', 'developer'],
-  tickets: ['admin', 'dba', 'developer', 'auditor'],
+  tickets: ['admin', 'dba', 'developer'],
   queries: ['admin', 'dba', 'developer'],
   roles: ['admin'],
   users: ['admin'],
-  'audit-logs': ['admin', 'dba'],
-  workflow: ['admin', 'dba'],
+  'audit-logs': ['admin', 'dba', 'auditor'],
+  workflow: ['admin', 'dba', 'developer', 'auditor'],
   'auto-task': ['admin'],
   settings: ['admin'],
 };
 
 export const actionPermissionMap: Record<string, UserRole[]> = {
   'ticket.create': ['admin', 'dba', 'developer'],
-  'ticket.approve': ['admin', 'dba'],
+  'ticket.approve': ['admin', 'dba', 'developer'],
   'ticket.execute': ['admin', 'dba'],
   'ticket.rollback': ['admin', 'dba'],
   'ticket.delete': ['admin'],

frontend/src/pages/TicketDetailPage.tsx

@@ -226,9 +226,10 @@ export default function TicketDetailPage() {
       return { canApprove: false, canExecute: false, canRollback: false, canCancel: false };
     }
     const adminOrDba = auth.user.role === 'admin' || auth.user.role === 'dba';
+    const canApproveRole = adminOrDba || auth.user.role === 'developer';
     const applicant = ticket.applicant_id === auth.user.id;
     return {
-      canApprove: adminOrDba && (ticket.status === 'pending' || ticket.status === 'reviewing'),
+      canApprove: canApproveRole && (ticket.status === 'pending' || ticket.status === 'reviewing'),
       canExecute: adminOrDba && ticket.status === 'approved',
       canRollback: adminOrDba && (ticket.status === 'success' || ticket.status === 'failed'),
       canCancel: applicant && (ticket.status === 'pending' || ticket.status === 'reviewing'),