refactor: 重构权限组系统 — 新增 access_type/allowed_databases 字段 + 角色权限服务

重构 InstanceGroup 权限组系统，从细粒度 20+ 权限开关简化为 3 种类型模式。

改动:
- InstanceGroup 模型新增 access_type (readonly/datachange/ddl) 和 allowed_databases 字段
- 保留旧 permissions 字段以兼容已有数据
- Schema 新增 access_type 和 allowed_databases 字段
- API endpoint 更新 create/update 处理逻辑
- 新增 role_permissions.py 服务，提供角色权限查询

Refactor InstanceGroup permission system from 20+ fine-grained permission
switches to a simplified 3-type access model (readonly/datachange/ddl).

Changes:
- Add access_type and allowed_databases columns to InstanceGroup model
- Keep legacy permissions field for backward compatibility
- Update schemas with new fields
- Update API endpoint create/update logic
- Add role_permissions.py service with role-based permission queries

backend/app/api/v1/endpoints/instance_group.py

@@ -25,7 +25,11 @@ def _serialize_group(group: InstanceGroup, instance_count: int = 0, user_count:
         "name": group.name,
         "description": group.description,
         "db_type": group.db_type,
+        # Legacy field
         "permissions": group.get_permissions(),
+        # New fields
+        "access_type": group.access_type,
+        "allowed_databases": group.get_allowed_databases(),
         "is_active": group.is_active,
         "created_at": group.created_at,
         "updated_at": group.updated_at,
@@ -95,6 +99,14 @@ async def create_instance_group(
         name=data.name,
         description=data.description,
         db_type=data.db_type,
+        # New fields
+        access_type=data.access_type,
+        allowed_databases=(
+            json.dumps(data.allowed_databases, ensure_ascii=False)
+            if data.allowed_databases
+            else None
+        ),
+        # Legacy field (kept for compat)
         permissions=json.dumps(data.permissions, ensure_ascii=False) if data.permissions else None,
         is_active=data.is_active,
     )
@@ -145,6 +157,7 @@ async def update_instance_group(
         if existing.scalar_one_or_none():
             raise HTTPException(status_code=400, detail="权限组名称已存在")
 
+    # Handle legacy permissions field
     if "permissions" in update_data:
         update_data["permissions"] = (
             json.dumps(update_data["permissions"], ensure_ascii=False)
@@ -152,6 +165,14 @@ async def update_instance_group(
             else None
         )
 
+    # Handle new allowed_databases field
+    if "allowed_databases" in update_data:
+        update_data["allowed_databases"] = (
+            json.dumps(update_data["allowed_databases"], ensure_ascii=False)
+            if update_data["allowed_databases"]
+            else None
+        )
+
     for key, value in update_data.items():
         setattr(group, key, value)
     await db.commit()