refactor: 重构权限组系统 — 新增 access_type/allowed_databases 字段 + 角色权限服务

重构 InstanceGroup 权限组系统，从细粒度 20+ 权限开关简化为 3 种类型模式。

改动:
- InstanceGroup 模型新增 access_type (readonly/datachange/ddl) 和 allowed_databases 字段
- 保留旧 permissions 字段以兼容已有数据
- Schema 新增 access_type 和 allowed_databases 字段
- API endpoint 更新 create/update 处理逻辑
- 新增 role_permissions.py 服务，提供角色权限查询

Refactor InstanceGroup permission system from 20+ fine-grained permission
switches to a simplified 3-type access model (readonly/datachange/ddl).

Changes:
- Add access_type and allowed_databases columns to InstanceGroup model
- Keep legacy permissions field for backward compatibility
- Update schemas with new fields
- Update API endpoint create/update logic
- Add role_permissions.py service with role-based permission queries

backend/app/schemas/instance_group.py

@@ -1,12 +1,22 @@
 from datetime import datetime
 from typing import Optional, List
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, ConfigDict, Field, field_validator
 
 
 class InstanceGroupCreate(BaseModel):
     name: str = Field(..., min_length=1, max_length=100)
     description: Optional[str] = None
     db_type: str = Field(default="all", pattern=r"^(mysql|redis|pg|mongo|all)$")
+    access_type: str = Field(
+        default="readonly",
+        pattern=r"^(readonly|datachange|ddl)$",
+        description="权限组类型: readonly(只读查询) / datachange(数据变更) / ddl(DDL变更)",
+    )
+    allowed_databases: Optional[List[str]] = Field(
+        default=None,
+        description="允许访问的数据库名列表，为空表示关联实例的所有库",
+    )
+    # Legacy field kept for backward compatibility
     permissions: Optional[List[str]] = None
     is_active: bool = True
 
@@ -15,6 +25,16 @@ class InstanceGroupUpdate(BaseModel):
     name: Optional[str] = Field(default=None, min_length=1, max_length=100)
     description: Optional[str] = None
     db_type: Optional[str] = Field(default=None, pattern=r"^(mysql|redis|pg|mongo|all)$")
+    access_type: Optional[str] = Field(
+        default=None,
+        pattern=r"^(readonly|datachange|ddl)$",
+        description="权限组类型: readonly(只读查询) / datachange(数据变更) / ddl(DDL变更)",
+    )
+    allowed_databases: Optional[List[str]] = Field(
+        default=None,
+        description="允许访问的数据库名列表，为空表示关联实例的所有库",
+    )
+    # Legacy field kept for backward compatibility
     permissions: Optional[List[str]] = None
     is_active: Optional[bool] = None
 
@@ -24,7 +44,11 @@ class InstanceGroupResponse(BaseModel):
     name: str
     description: Optional[str] = None
     db_type: str
+    # Legacy field
     permissions: Optional[List[str]] = None
+    # New fields
+    access_type: Optional[str] = None
+    allowed_databases: Optional[List[str]] = None
     is_active: bool
     created_at: Optional[datetime] = None
     updated_at: Optional[datetime] = None