fix: 撤销工单支持approved状态 + DDL跳过EXPLAIN预检 + 审批菜单仅admin/dba + 审批状态流转修复 + 权限组实例绑定修复

frontend/src/constants/menu.ts

@@ -12,12 +12,12 @@ export const menuItems = [
 
   // 管理 — 数据源 + 权限
   { id: 'instances', label: '数据源', icon: 'Database', section: 'admin', roles: ['admin', 'dba'], permission: 'instances.manage' },
+  { id: 'workflow', label: '审批流程', icon: 'GitBranch', section: 'admin', roles: ['admin', 'dba'], permission: 'workflow.manage' },
   { id: 'users', label: '用户管理', icon: 'Users', section: 'admin', roles: ['admin'], permission: 'users.manage' },
   { id: 'roles', label: '角色权限', icon: 'ShieldCheck', section: 'admin', roles: ['admin'], permission: 'roles.manage' },
   { id: 'instance-groups', label: '权限组', icon: 'FolderLock', section: 'admin', roles: ['admin'], permission: 'instance-groups.manage' },
 
   // 系统
-  { id: 'workflow', label: '审批流程', icon: 'GitBranch', section: 'system', roles: ['admin', 'dba', 'developer', 'auditor'], permission: 'workflow.manage' },
   { id: 'audit-logs', label: '审计日志', icon: 'ScrollText', section: 'system', roles: ['admin', 'dba', 'auditor'], permission: 'audit-logs.view' },
   { id: 'auto-task', label: '自动任务', icon: 'Timer', section: 'system', roles: ['admin'], permission: 'auto-task.manage' },
   { id: 'settings', label: '系统设置', icon: 'Settings', section: 'system', roles: ['admin'], permission: 'settings.manage' },

frontend/src/pages/TicketDetailPage.tsx

@@ -232,7 +232,7 @@ export default function TicketDetailPage() {
       canApprove: canApproveRole && (ticket.status === 'pending' || ticket.status === 'reviewing'),
       canExecute: adminOrDba && ticket.status === 'approved',
       canRollback: adminOrDba && (ticket.status === 'success' || ticket.status === 'failed'),
-      canCancel: applicant && (ticket.status === 'pending' || ticket.status === 'reviewing'),
+      canCancel: applicant && (ticket.status === 'pending' || ticket.status === 'reviewing' || ticket.status === 'approved'),
     };
   }, [ticket, auth.user.role, auth.user.id]);
 

frontend/src/pages/TicketsPage.tsx

@@ -490,7 +490,7 @@ export default function TicketsPage() {
                             </button>
                           )}
 
-                          {(ticket.status === 'pending' || ticket.status === 'reviewing') && (
+                          {(ticket.status === 'pending' || ticket.status === 'reviewing' || ticket.status === 'approved') && (
                             <button
                               onClick={async () => {
                                 try {

frontend/src/pages/WorkflowPage.tsx

@@ -282,7 +282,7 @@ function WorkflowEditorModal({ workflow, users, onClose, onSaved }: EditorProps)
 
   const getEligibleUsers = (stepType: string) => {
     const active = users.filter(u => u.is_active);
-    if (stepType === 'audit') return active.filter(u => ['admin', 'superadmin', 'dba', 'auditor'].includes(u.role));
+    if (stepType === 'audit') return active.filter(u => ['admin', 'superadmin', 'dba', 'developer', 'auditor'].includes(u.role));
     if (stepType === 'execute') return active.filter(u => ['admin', 'superadmin', 'dba'].includes(u.role));
     return active;
   };