refactor：用 AdminApiList 统一后台列表类接口的响应格式

tests/Feature/AdminUserPermissionApiTest.php

@@ -153,3 +153,127 @@ test('admin can sync user roles for default site', function (): void {
     sort($slugs);
     expect($slugs)->toBe(['role_sync_a', 'role_sync_b']);
 });
+
+test('admin can create update and delete users with crud rules', function (): void {
+    $token = makeAdminWithPermissions('crud_actor', ['prd.admin_user.manage']);
+
+    $crudRole = AdminRole::query()->create(['slug' => 'crud_new_user_role', 'name' => 'Crud Role']);
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->postJson('/api/v1/admin/admin-users', [
+            'username' => 'NewUser_XX',
+            'nickname' => '新用户',
+            'email' => 'newuser@example.com',
+            'password' => 'secret-long',
+            'status' => 0,
+            'role_slugs' => ['crud_new_user_role'],
+        ])
+        ->assertOk()
+        ->assertJsonPath('code', ErrorCode::Success->value)
+        ->assertJsonPath('data.username', 'newuser_xx')
+        ->assertJsonPath('data.roles.0', 'crud_new_user_role');
+
+    $created = AdminUser::query()->where('username', 'newuser_xx')->firstOrFail();
+    expect($created->adminRoleSlugs())->toContain('crud_new_user_role');
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->postJson('/api/v1/admin/admin-users', [
+            'username' => 'newuser_xx',
+            'nickname' => 'dup',
+            'email' => null,
+            'password' => 'secret-long',
+            'role_slugs' => [$crudRole->slug],
+        ])
+        ->assertStatus(422)
+        ->assertJsonPath('code', ErrorCode::ValidationFailed->value);
+
+    $target = AdminUser::query()->where('username', 'newuser_xx')->firstOrFail();
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->putJson('/api/v1/admin/admin-users/'.$target->id, [
+            'nickname' => '已改名',
+            'email' => null,
+            'password' => 'new-secret-9',
+        ])
+        ->assertOk()
+        ->assertJsonPath('data.nickname', '已改名');
+
+    expect(Hash::check('new-secret-9', $target->fresh()->password))->toBeTrue();
+
+    $victim = AdminUser::query()->create([
+        'username' => 'to_delete',
+        'name' => 'Delete Me',
+        'email' => null,
+        'password' => Hash::make('secret-strong'),
+        'status' => 0,
+    ]);
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->deleteJson('/api/v1/admin/admin-users/'.$victim->id)
+        ->assertOk()
+        ->assertJsonPath('data.deleted', true);
+
+    expect(AdminUser::query()->whereKey($victim->id)->exists())->toBeFalse();
+});
+
+test('admin user create requires at least one role slug', function (): void {
+    $token = makeAdminWithPermissions('create_need_roles', ['prd.admin_user.manage']);
+    AdminRole::query()->create(['slug' => 'role_for_create_gate', 'name' => 'Gate Role']);
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->postJson('/api/v1/admin/admin-users', [
+            'username' => 'no_roles_user',
+            'nickname' => 'NR',
+            'email' => null,
+            'password' => 'secret-long',
+            'role_slugs' => [],
+        ])
+        ->assertStatus(422)
+        ->assertJsonPath('code', ErrorCode::ValidationFailed->value);
+});
+
+test('admin cannot delete self', function (): void {
+    $token = makeAdminWithPermissions('self_guard', ['prd.admin_user.manage']);
+    $me = AdminUser::query()->where('username', 'self_guard')->firstOrFail();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->deleteJson('/api/v1/admin/admin-users/'.$me->id)
+        ->assertStatus(422)
+        ->assertJsonPath('code', ErrorCode::ValidationFailed->value)
+        ->assertJsonPath('msg', '不能删除当前登录账号');
+});
+
+test('admin cannot delete the last super admin', function (): void {
+    $token = makeAdminWithPermissions('super_deleter', ['prd.admin_user.manage']);
+
+    $s1 = AdminUser::query()->create([
+        'username' => 'super_one',
+        'name' => 'S1',
+        'email' => null,
+        'password' => Hash::make('secret-strong'),
+        'status' => 0,
+    ]);
+    grantSuperAdminRole($s1);
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->deleteJson('/api/v1/admin/admin-users/'.$s1->id)
+        ->assertStatus(422)
+        ->assertJsonPath('msg', '不能删除最后一个超级管理员');
+
+    $s2 = AdminUser::query()->create([
+        'username' => 'super_two',
+        'name' => 'S2',
+        'email' => null,
+        'password' => Hash::make('secret-strong'),
+        'status' => 0,
+    ]);
+    grantSuperAdminRole($s2);
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->deleteJson('/api/v1/admin/admin-users/'.$s1->id)
+        ->assertOk();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->deleteJson('/api/v1/admin/admin-users/'.$s2->id)
+        ->assertStatus(422)
+        ->assertJsonPath('msg', '不能删除最后一个超级管理员');
+});