feat: 角色权限体系改造 — developer可审批, auditor纯只读

角色权限矩阵:
- admin: 全部权限
- dba: 数据源管理+工单全流程+审批+执行
- developer: 查询+提交工单+审批(不能执行)
- auditor: 只读(审计日志+审核规则+审批流程查看)

后端改动:
- ticket.go: 修复GetCurrentUser返回值顺序bug(userID,username,role)
- ticket.go: CreateTicket拦截auditor提交工单
- ticket.go: ApproveTicket允许admin/dba/developer
- ticket.go: ExecuteTicket仅允许admin/dba
- router.go: query执行限制admin/dba/developer
- router.go: workflow写操作限制admin/dba
- router.go: audit-rules写操作限制admin/dba

前端改动:
- menu.ts: tickets去掉auditor, workflow加developer+auditor, audit-logs加auditor
- useAuth.tsx: routePermissionMap和actionPermissionMap同步更新
- TicketDetailPage: canApprove加developer角色

DB迁移: test123/test234从auditor→developer

frontend/src/hooks/useAuth.tsx

@@ -114,19 +114,19 @@ const routePermissionMap: Record<string, UserRole[]> = {
   instances: ['admin', 'dba'],
   'instance-groups': ['admin'],
   'data-dictionary': ['admin', 'dba', 'developer'],
-  tickets: ['admin', 'dba', 'developer', 'auditor'],
+  tickets: ['admin', 'dba', 'developer'],
   queries: ['admin', 'dba', 'developer'],
   roles: ['admin'],
   users: ['admin'],
-  'audit-logs': ['admin', 'dba'],
-  workflow: ['admin', 'dba'],
+  'audit-logs': ['admin', 'dba', 'auditor'],
+  workflow: ['admin', 'dba', 'developer', 'auditor'],
   'auto-task': ['admin'],
   settings: ['admin'],
 };
 
 export const actionPermissionMap: Record<string, UserRole[]> = {
   'ticket.create': ['admin', 'dba', 'developer'],
-  'ticket.approve': ['admin', 'dba'],
+  'ticket.approve': ['admin', 'dba', 'developer'],
   'ticket.execute': ['admin', 'dba'],
   'ticket.rollback': ['admin', 'dba'],
   'ticket.delete': ['admin'],