fix: 权限组穿梭框保存不生效 + 弹框布局修复

1. 后端 CreateInstanceGroup 改用 input struct 接收 readonly_instance_ids/write_instance_ids
   - 旧代码直接绑定 model.InstanceGroup（不含关联ID字段），导致穿梭框数据被丢弃
   - 新代码解析后写入 instance_group_members 表
   - 与 UpdateInstanceGroup 保持一致的逻辑

2. 弹框布局修复
   - z-50 → z-[100] 避免被顶部栏遮挡
   - flex-col + overflow-y-auto 独立滚动区域
   - 添加 header bar + X 关闭按钮
   - 背景加 backdrop-blur-sm

3. 全局排查确认：其他 handler 均使用 input struct 或 map，无同类问题

backend/internal/handler/instance_group.go

@@ -25,15 +25,55 @@ func GetInstanceGroup(c *gin.Context) {
 
 // POST /api/v1/instance-groups
 func CreateInstanceGroup(c *gin.Context) {
-	var group model.InstanceGroup
-	if err := c.ShouldBindJSON(&group); err != nil {
+	var input struct {
+		Name                string  `json:"name"`
+		Description         *string `json:"description"`
+		DBType              string  `json:"db_type"`
+		IsActive            *bool   `json:"is_active"`
+		ReadonlyInstanceIDs []int   `json:"readonly_instance_ids"`
+		WriteInstanceIDs    []int   `json:"write_instance_ids"`
+	}
+	if err := c.ShouldBindJSON(&input); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
 		return
 	}
+
+	desc := ""
+	if input.Description != nil {
+		desc = *input.Description
+	}
+	isActive := true
+	if input.IsActive != nil {
+		isActive = *input.IsActive
+	}
+	dbType := input.DBType
+	if dbType == "" {
+		dbType = "all"
+	}
+
+	group := model.InstanceGroup{
+		Name:        input.Name,
+		Description: &desc,
+		DBType:      dbType,
+		IsActive:    &isActive,
+	}
 	if err := model.DB.Create(&group).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"detail": err.Error()})
 		return
 	}
+
+	// Create instance members
+	for _, iid := range input.ReadonlyInstanceIDs {
+		model.DB.Create(&model.InstanceGroupMember{
+			GroupID: group.ID, InstanceID: iid, AccessType: "readonly",
+		})
+	}
+	for _, iid := range input.WriteInstanceIDs {
+		model.DB.Create(&model.InstanceGroupMember{
+			GroupID: group.ID, InstanceID: iid, AccessType: "write",
+		})
+	}
+
 	c.JSON(http.StatusCreated, enrichGroup(group))
 }