feat(admin): 更新后台权限管理与同步逻辑，简化权限检查并优化文档

- 新增后台 RBAC 相关文档，提供权限目录与维护命令说明。
- 移除不必要的角色资源同步检查，简化权限审计命令。
- 更新权限描述与同步逻辑，确保一致性与可维护性。
- 统一权限注册表，替换过时的权限别名，增强代码可读性。

database/migrations/2026_05_22_100000_add_admin_report_module.php

@@ -128,20 +128,6 @@ return new class extends Migration
             ]);
         }
 
-        $roleResourceRows = DB::table('admin_role_menu_actions as rma')
-            ->join('admin_api_resource_bindings as arb', 'arb.menu_action_id', '=', 'rma.menu_action_id')
-            ->join('admin_api_resources as ar', 'ar.id', '=', 'arb.api_resource_id')
-            ->whereIn('ar.code', $reportResourceCodes)
-            ->select('rma.role_id', 'arb.api_resource_id')
-            ->distinct()
-            ->get();
-
-        foreach ($roleResourceRows as $row) {
-            DB::table('admin_role_api_resources')->updateOrInsert([
-                'role_id' => (int) $row->role_id,
-                'api_resource_id' => (int) $row->api_resource_id,
-            ], []);
-        }
     }
 
     public function down(): void
@@ -159,7 +145,6 @@ return new class extends Migration
 
         $resourceIds = DB::table('admin_api_resources')->whereIn('code', $codes)->pluck('id');
         foreach ($resourceIds as $resourceId) {
-            DB::table('admin_role_api_resources')->where('api_resource_id', (int) $resourceId)->delete();
             DB::table('admin_api_resource_bindings')->where('api_resource_id', (int) $resourceId)->delete();
             DB::table('admin_api_resources')->where('id', (int) $resourceId)->delete();
         }

database/migrations/2026_05_22_110000_fix_admin_report_authorization.php

@@ -0,0 +1,122 @@
+<?php
+
+use App\Support\AdminAuthorizationRegistry;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    /** @var list<string> */
+    private const STALE_RESOURCE_CODES = [
+        'admin.reports.index',
+        'admin.reports.store',
+        'admin.reconcile.index',
+        'admin.reconcile.store',
+        'admin.draws.publish',
+    ];
+
+    /** @var list<string> */
+    private const REPORT_RESOURCE_CODES = [
+        'admin.reports.daily-profit',
+        'admin.reports.player-win-loss',
+        'admin.reports.play-dimension',
+        'admin.reports.rebate-commission',
+        'admin.report-jobs.index',
+        'admin.report-jobs.store',
+        'admin.report-jobs.show',
+        'admin.report-jobs.download',
+    ];
+
+    public function up(): void
+    {
+        $now = Carbon::now();
+
+        $this->deleteStaleApiResources();
+        $this->ensureReportViewOnRolesWithReportLegacy();
+        $this->syncReportResourceBindings($now);
+    }
+
+    public function down(): void
+    {
+        // 绑定收紧与角色补权为数据修复，不回滚以免再现漂移。
+    }
+
+    private function deleteStaleApiResources(): void
+    {
+        $resourceIds = DB::table('admin_api_resources')
+            ->whereIn('code', self::STALE_RESOURCE_CODES)
+            ->pluck('id');
+
+        foreach ($resourceIds as $resourceId) {
+            $id = (int) $resourceId;
+            DB::table('admin_api_resource_bindings')->where('api_resource_id', $id)->delete();
+            DB::table('admin_api_resources')->where('id', $id)->delete();
+        }
+    }
+
+    private function ensureReportViewOnRolesWithReportLegacy(): void
+    {
+        $menuActionId = DB::table('admin_menu_actions')
+            ->where('permission_code', 'service.report.view')
+            ->where('status', 1)
+            ->value('id');
+
+        if ($menuActionId === null) {
+            return;
+        }
+
+        $reportSlugs = ['prd.report.view', 'prd.report.all', 'prd.report.risk', 'prd.report.finance', 'prd.report.player'];
+        $roleIds = DB::table('admin_role_legacy_permissions')
+            ->whereIn('permission_slug', $reportSlugs)
+            ->distinct()
+            ->pluck('role_id');
+
+        foreach ($roleIds as $roleId) {
+            DB::table('admin_role_menu_actions')->updateOrInsert([
+                'role_id' => (int) $roleId,
+                'menu_action_id' => (int) $menuActionId,
+            ]);
+        }
+    }
+
+    private function syncReportResourceBindings(Carbon $now): void
+    {
+        $menuActionIds = DB::table('admin_menu_actions')->pluck('id', 'permission_code');
+        $registryByCode = [];
+        foreach (AdminAuthorizationRegistry::resources() as $resource) {
+            $registryByCode[$resource['code']] = $resource;
+        }
+
+        foreach (self::REPORT_RESOURCE_CODES as $code) {
+            $resource = $registryByCode[$code] ?? null;
+            if ($resource === null) {
+                continue;
+            }
+
+            $resourceId = DB::table('admin_api_resources')->where('code', $code)->value('id');
+            if ($resourceId === null) {
+                continue;
+            }
+
+            DB::table('admin_api_resource_bindings')
+                ->where('api_resource_id', (int) $resourceId)
+                ->delete();
+
+            foreach ($resource['permission_codes'] as $permissionCode) {
+                $menuActionId = $menuActionIds[$permissionCode] ?? null;
+                if ($menuActionId === null) {
+                    continue;
+                }
+
+                DB::table('admin_api_resource_bindings')->insert([
+                    'api_resource_id' => (int) $resourceId,
+                    'menu_action_id' => (int) $menuActionId,
+                    'created_at' => $now,
+                    'updated_at' => $now,
+                ]);
+            }
+        }
+    }
+
+};

database/migrations/2026_05_22_120000_drop_redundant_admin_and_system_tables.php

@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * 移除未接入业务或已由其它表替代的冗余表：
+ * - system_jobs：从未使用
+ * - admin_role_menus：侧栏改由 prd.* + Registry 驱动
+ * - admin_role_api_resources：鉴权由 role_menu_actions + bindings 实时推导
+ * - admin_*_data_scopes：数据范围未落地
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::dropIfExists('admin_user_data_scopes');
+        Schema::dropIfExists('admin_role_data_scopes');
+        Schema::dropIfExists('admin_data_scopes');
+        Schema::dropIfExists('admin_role_api_resources');
+        Schema::dropIfExists('admin_role_menus');
+        Schema::dropIfExists('system_jobs');
+    }
+
+    public function down(): void
+    {
+        // 冗余表删除为单向清理，不回滚。
+    }
+};

database/migrations/2026_05_22_130000_consolidate_admin_rbac_slugs.php

@@ -0,0 +1,46 @@
+<?php
+
+use App\Models\AdminRole;
+use App\Support\AdminPermissionBridge;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (! Schema::hasTable('admin_role_legacy_permissions')) {
+            return;
+        }
+
+        $roleIds = DB::table('admin_roles')->pluck('id');
+
+        foreach ($roleIds as $roleId) {
+            $legacySlugs = DB::table('admin_role_legacy_permissions')
+                ->where('role_id', (int) $roleId)
+                ->pluck('permission_slug')
+                ->all();
+
+            $slugs = AdminPermissionBridge::normalizeCanonicalLegacySlugs(
+                is_array($legacySlugs) ? $legacySlugs : [],
+            );
+
+            if ($slugs === []) {
+                continue;
+            }
+
+            $role = AdminRole::query()->find((int) $roleId);
+            if ($role !== null) {
+                $role->syncLegacyPermissionSlugs($slugs);
+            }
+        }
+
+        Schema::dropIfExists('admin_role_legacy_permissions');
+    }
+
+    public function down(): void
+    {
+        // 单向清理：slug 已合并，权限以 admin_role_menu_actions 为准。
+    }
+};