feat: 管理端 RBAC 权限体系与员工管理

新增多角色权限控制（赛事/财务/客服管理员），支持员工 CRUD、路由菜单按权限显隐、审计日志范围过滤；登录返回角色与权限列表。玩家端赛事列表增加静默刷新避免图片闪烁。Seed 补充演示员工账号与充值相关权限。附带 RBAC/审计范围单元测试及 UAT 文档更新。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/admin/src/views/Settlement.vue

@@ -5,6 +5,8 @@ import { formatApiErrorMessage, isApiErrorCode } from '@thebet365/shared';
 import api from '../api';
 import { ElMessage } from 'element-plus';
 import { useAdminLocale } from '../composables/useAdminLocale';
+import { usePermissions } from '../composables/usePermissions';
+import { AdminPerm } from '../constants/permissions';
 
 const VChart = defineAsyncComponent(() =>
   import('../components/dashboard/echarts-setup').then((m) => m.VChart),
@@ -69,6 +71,8 @@ interface SettlementBetStats {
 }
 
 const { t, locale, localeTag } = useAdminLocale();
+const { hasPermission } = usePermissions();
+const canResettle = computed(() => hasPermission(AdminPerm.resettle));
 const route = useRoute();
 const router = useRouter();
 const STAT_FACT_LABELS = {
@@ -770,7 +774,7 @@ onMounted(() => {
               isOutright ? t('settlement.outright.preview_hint') : t('settlement.preview_hint')
             }}</span>
           </template>
-          <template v-else>
+          <template v-else-if="canResettle">
             <el-input
               v-model="resettleReason"
               size="small"
@@ -787,7 +791,7 @@ onMounted(() => {
 
     <!-- 智能比分弹窗已关闭（见 Settlement.vue git 历史） -->
 
-    <el-card v-if="resettlePreview" class="preview-card" shadow="never">
+    <el-card v-if="canResettle && resettlePreview" class="preview-card" shadow="never">
       <div class="preview-title">{{ t('settlement.resettle_preview_title') }}</div>
       <el-row :gutter="20">
         <el-col :span="8">