feat: 管理端 RBAC 权限体系与员工管理

新增多角色权限控制（赛事/财务/客服管理员），支持员工 CRUD、路由菜单按权限显隐、审计日志范围过滤；登录返回角色与权限列表。玩家端赛事列表增加静默刷新避免图片闪烁。Seed 补充演示员工账号与充值相关权限。附带 RBAC/审计范围单元测试及 UAT 文档更新。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/admin/src/components/DashboardSubNav.vue

@@ -1,9 +1,13 @@
 <script setup lang="ts">
+import { computed } from 'vue';
 import { RouterLink, useRoute } from 'vue-router';
 import { useAdminLocale } from '../composables/useAdminLocale';
+import { usePermissions } from '../composables/usePermissions';
+import { AdminPerm } from '../constants/permissions';
 
 const { t } = useAdminLocale();
 const route = useRoute();
+const { hasPermission, role } = usePermissions();
 
 withDefaults(
   defineProps<{
@@ -12,10 +16,21 @@ withDefaults(
   { embedded: false },
 );
 
-const tabs = [
-  { path: '/', labelKey: 'nav.dashboard.matches' },
-  { path: '/dashboard/players', labelKey: 'nav.dashboard.players' },
-];
+const tabs = computed(() => {
+  const list: { path: string; labelKey: string }[] = [];
+  const code = role.value;
+  if (code === 'SUPPORT') return list;
+  if (hasPermission(AdminPerm.matches)) {
+    list.push({ path: '/', labelKey: 'nav.dashboard.matches' });
+  }
+  if (
+    hasPermission(AdminPerm.reports) &&
+    (code === 'FINANCE_ADMIN' || code === 'SUPER_ADMIN' || list.length === 0)
+  ) {
+    list.push({ path: '/dashboard/players', labelKey: 'nav.dashboard.players' });
+  }
+  return list;
+});
 
 function isActive(path: string) {
   if (path === '/dashboard/players') {
@@ -27,6 +42,7 @@ function isActive(path: string) {
 
 <template>
   <nav
+    v-if="tabs.length > 1"
     class="dashboard-subnav"
     :class="{ 'dashboard-subnav--embedded': embedded }"
     aria-label="Dashboard sections"