fix(auth): enforce password and agent role boundaries

database/migrations/2026_07_21_150000_remove_cross_site_agent_role_assignments.php

@@ -0,0 +1,17 @@
+<?php
+
+use App\Support\InvalidPlatformAgentRoleCleanup;
+use Illuminate\Database\Migrations\Migration;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        InvalidPlatformAgentRoleCleanup::run();
+    }
+
+    public function down(): void
+    {
+        // 不回滚：恢复跨站非法代理角色会重新扩大权限。
+    }
+};