feat: 管理端 RBAC 权限体系与员工管理

新增多角色权限控制（赛事/财务/客服管理员），支持员工 CRUD、路由菜单按权限显隐、审计日志范围过滤；登录返回角色与权限列表。玩家端赛事列表增加静默刷新避免图片闪烁。Seed 补充演示员工账号与充值相关权限。附带 RBAC/审计范围单元测试及 UAT 文档更新。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/admin/src/composables/usePermissions.ts

@@ -0,0 +1,43 @@
+import { computed } from 'vue';
+import { useAuthStore } from '../stores/auth';
+import { effectivePermissions } from '../utils/admin-access';
+
+export function usePermissions() {
+  const auth = useAuthStore();
+
+  const role = computed(() => auth.user.value?.role ?? null);
+  const permissions = computed(() =>
+    effectivePermissions(auth.user.value?.role, auth.user.value?.permissions),
+  );
+  const isSuperAdmin = computed(() => role.value === 'SUPER_ADMIN');
+
+  function hasPermission(...codes: string[]): boolean {
+    if (!auth.isAdmin.value) return false;
+    if (isSuperAdmin.value) return true;
+    const set = permissions.value;
+    return codes.some((c) => set.includes(c));
+  }
+
+  function hasAllPermissions(...codes: string[]): boolean {
+    if (!auth.isAdmin.value) return false;
+    if (isSuperAdmin.value) return true;
+    const set = permissions.value;
+    return codes.every((c) => set.includes(c));
+  }
+
+  function firstAllowedPath(candidates: { path: string; permissions: string[] }[]): string | null {
+    for (const item of candidates) {
+      if (hasPermission(...item.permissions)) return item.path;
+    }
+    return null;
+  }
+
+  return {
+    role,
+    permissions,
+    isSuperAdmin,
+    hasPermission,
+    hasAllPermissions,
+    firstAllowedPath,
+  };
+}