feat: 增强代理和玩家管理功能

- 在 SyncAdminAuthorizationCommand 中新增对代理线路和结算菜单操作的同步功能，确保缺失的菜单操作行能够被创建。
- 更新多个控制器中的权限检查逻辑，使用 hasPermissionCode 替代原有的权限验证方式，提升权限管理的灵活性。
- 在 AdminPlayerStoreController 中引入对玩家创建能力的验证，确保只有具备相应权限的管理员能够创建玩家。
- 更新请求验证逻辑，新增 credit_limit、rebate_rate 和 extra_rebate_rate 字段，以支持更细粒度的玩家管理。
- 在 AdminUser 和 AgentNode 模型中增强角色与用户的权限管理功能，支持更细粒度的权限控制。

tests/Feature/AdminUserPermissionApiTest.php

@@ -2,10 +2,13 @@
 
 use App\Models\AdminRole;
 use App\Models\AdminUser;
+use App\Models\AgentNode;
 use App\Lottery\ErrorCode;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 use App\Support\AdminPermissionBridge;
+use App\Services\Agent\AgentNodeService;
+use App\Services\Agent\AgentAdminUserService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 
 uses(RefreshDatabase::class);
@@ -47,7 +50,7 @@ test('admin user permission apis require rbac permission', function (): void {
         ->assertJsonPath('code', ErrorCode::AdminForbidden->value);
 });
 
-test('admin can list users and sync direct permissions', function (): void {
+test('admin can list platform users and read effective permissions', function (): void {
     $token = makeAdminWithPermissions('rbac_manager', ['prd.admin_user.manage']);
 
     $target = AdminUser::query()->create([
@@ -93,23 +96,12 @@ test('admin can list users and sync direct permissions', function (): void {
         ->assertJsonPath('data.items.0.username', 'target_user')
         ->assertJsonPath('data.items.0.roles.0', 'target_role');
 
-    $this->withHeader('Authorization', 'Bearer '.$token)
-        ->putJson('/api/v1/admin/admin-users/'.$target->id.'/permissions', [
-            'permission_slugs' => ['prd.report.view'],
-        ])
-        ->assertOk()
-        ->assertJsonPath('code', ErrorCode::Success->value)
-        ->assertJsonFragment(['prd.report.view']);
-
-    expect($target->fresh()->directLegacyPermissionSlugs())->toContain('prd.report.view');
-
     $list = $this->withHeader('Authorization', 'Bearer '.$token)
         ->getJson('/api/v1/admin/admin-users?keyword=target')
         ->assertOk()
         ->json('data.items.0.effective_permissions');
 
     expect($list)->toContain('prd.draw_result.view');
-    expect($list)->toContain('prd.report.view');
 });
 
 test('admin can sync user roles for default site', function (): void {
@@ -138,6 +130,101 @@ test('admin can sync user roles for default site', function (): void {
     expect($slugs)->toBe(['role_sync_a', 'role_sync_b']);
 });
 
+test('platform admin users list excludes agent accounts', function (): void {
+    $token = makeAdminWithPermissions('platform_list_manager', ['prd.admin_user.manage']);
+
+    $platformUser = AdminUser::query()->create([
+        'username' => 'platform_only_user',
+        'name' => 'Platform Only',
+        'email' => null,
+        'password' => Hash::make('secret-strong'),
+        'status' => 0,
+    ]);
+
+    $siteId = AdminUser::defaultAdminSiteId();
+    $root = AgentNode::query()->where('admin_site_id', $siteId)->where('depth', 0)->firstOrFail();
+
+    $super = AdminUser::query()->create([
+        'username' => 'agent_list_super',
+        'name' => 'Super',
+        'email' => null,
+        'password' => Hash::make('secret-strong'),
+        'status' => 0,
+    ]);
+    grantSuperAdminRole($super);
+
+    $branch = app(AgentNodeService::class)->createChild($super, [
+        'parent_id' => (int) $root->id,
+        'code' => 'list-branch',
+        'name' => 'List Branch',
+    ]);
+
+    app(AgentAdminUserService::class)->createUnderAgent($branch, [
+        'username' => 'agent_hidden_user',
+        'nickname' => 'Agent Hidden',
+        'password' => 'secret-strong-2',
+        'role_ids' => [],
+    ]);
+
+    $items = $this->withHeader('Authorization', 'Bearer '.$token)
+        ->getJson('/api/v1/admin/admin-users')
+        ->assertOk()
+        ->json('data.items');
+
+    expect(collect($items)->pluck('username')->all())
+        ->toContain('platform_only_user')
+        ->not->toContain('agent_hidden_user');
+});
+
+test('platform account apis reject agent accounts and agent roles', function (): void {
+    $token = makeAdminWithPermissions('platform_scope_manager', ['prd.admin_user.manage', 'prd.admin_role.manage']);
+
+    $siteId = AdminUser::defaultAdminSiteId();
+    $root = AgentNode::query()->where('admin_site_id', $siteId)->where('depth', 0)->firstOrFail();
+
+    $super = AdminUser::query()->create([
+        'username' => 'platform_guard_super',
+        'name' => 'Super',
+        'email' => null,
+        'password' => Hash::make('secret-strong'),
+        'status' => 0,
+    ]);
+    grantSuperAdminRole($super);
+
+    $branch = app(AgentNodeService::class)->createChild($super, [
+        'parent_id' => (int) $root->id,
+        'code' => 'platform-guard-branch',
+        'name' => 'Platform Guard Branch',
+    ]);
+
+    $agentRole = AdminRole::query()->create([
+        'slug' => 'guard_agent_role',
+        'name' => 'Guard Agent Role',
+        'scope_type' => AdminRole::SCOPE_AGENT,
+        'owner_agent_id' => $branch->id,
+    ]);
+    $agentRole->syncLegacyPermissionSlugs(['prd.agent.role.view']);
+
+    $agentUser = app(AgentAdminUserService::class)->createUnderAgent($branch, [
+        'username' => 'guard_agent_user',
+        'nickname' => 'Guard Agent User',
+        'password' => 'secret-strong-3',
+        'role_ids' => [(int) $agentRole->id],
+    ]);
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->putJson('/api/v1/admin/admin-users/'.$agentUser->id.'/roles', [
+            'role_slugs' => ['guard_agent_role'],
+        ])
+        ->assertStatus(422);
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->putJson('/api/v1/admin/admin-roles/'.$agentRole->id.'/permissions', [
+            'permission_slugs' => ['prd.admin_role.manage'],
+        ])
+        ->assertStatus(422);
+});
+
 test('permission catalog groups permissions by admin navigation order', function (): void {
     $token = makeAdminWithPermissions('nav_group_catalog', ['prd.admin_user.manage', 'prd.admin_role.manage']);