refactor: 重构权限组系统 — 新增 access_type/allowed_databases 字段 + 角色权限服务

重构 InstanceGroup 权限组系统，从细粒度 20+ 权限开关简化为 3 种类型模式。

改动:
- InstanceGroup 模型新增 access_type (readonly/datachange/ddl) 和 allowed_databases 字段
- 保留旧 permissions 字段以兼容已有数据
- Schema 新增 access_type 和 allowed_databases 字段
- API endpoint 更新 create/update 处理逻辑
- 新增 role_permissions.py 服务，提供角色权限查询

Refactor InstanceGroup permission system from 20+ fine-grained permission
switches to a simplified 3-type access model (readonly/datachange/ddl).

Changes:
- Add access_type and allowed_databases columns to InstanceGroup model
- Keep legacy permissions field for backward compatibility
- Update schemas with new fields
- Update API endpoint create/update logic
- Add role_permissions.py service with role-based permission queries

backend/app/models/instance_group.py

@@ -1,4 +1,8 @@
+from __future__ import annotations
+
 import json
+from typing import List, Optional
+
 from sqlalchemy import Column, Integer, String, Text, Boolean, DateTime, ForeignKey, Table, func
 from sqlalchemy.orm import relationship
 
@@ -10,7 +14,7 @@ user_groups = Table(
     Base.metadata,
     Column("user_id", Integer, ForeignKey("users.id", ondelete="CASCADE"), primary_key=True),
     Column("group_id", Integer, ForeignKey("instance_groups.id", ondelete="CASCADE"), primary_key=True),
-    Column("permissions", Text, nullable=True),  # JSON: 覆盖组默认权限
+    Column("permissions", Text, nullable=True),  # JSON: 覆盖组默认权限 (legacy, kept for compat)
 )
 
 
@@ -21,7 +25,9 @@ class InstanceGroup(Base):
     name = Column(String(100), nullable=False, unique=True)
     description = Column(Text, nullable=True)
     db_type = Column(String(20), nullable=False, default="all")  # mysql/redis/pg/mongo/all
-    permissions = Column(Text, nullable=True)  # JSON: ["query:select", ...]
+    permissions = Column(Text, nullable=True)  # JSON: ["query:select", ...] (legacy, kept for compat)
+    access_type = Column(String(20), nullable=True, default="readonly")  # readonly / datachange / ddl
+    allowed_databases = Column(Text, nullable=True)  # JSON array of database names; empty = all databases
     is_active = Column(Boolean, default=True)
     created_at = Column(DateTime, server_default=func.now())
     updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now())
@@ -30,6 +36,8 @@ class InstanceGroup(Base):
     instances = relationship("Instance", back_populates="group", lazy="selectin")
     users = relationship("User", secondary=user_groups, back_populates="groups", lazy="selectin")
 
+    # ---- Legacy helpers (kept for backward compatibility) ----
+
     def get_permissions(self) -> list:
         if self.permissions:
             try:
@@ -40,3 +48,21 @@ class InstanceGroup(Base):
 
     def set_permissions(self, perms: list):
         self.permissions = json.dumps(perms, ensure_ascii=False) if perms else None
+
+    # ---- New access_type / allowed_databases helpers ----
+
+    def get_allowed_databases(self) -> list[str]:
+        """返回允许的数据库名列表，空列表表示关联实例的所有库。"""
+        if self.allowed_databases:
+            try:
+                return json.loads(self.allowed_databases)
+            except (json.JSONDecodeError, TypeError):
+                return []
+        return []
+
+    def set_allowed_databases(self, databases: list[str] | None):
+        self.allowed_databases = (
+            json.dumps(databases, ensure_ascii=False) if databases else None
+        )
+
+    VALID_ACCESS_TYPES = {"readonly", "datachange", "ddl"}