feat: 管理端 RBAC 权限体系与员工管理

新增多角色权限控制（赛事/财务/客服管理员），支持员工 CRUD、路由菜单按权限显隐、审计日志范围过滤；登录返回角色与权限列表。玩家端赛事列表增加静默刷新避免图片闪烁。Seed 补充演示员工账号与充值相关权限。附带 RBAC/审计范围单元测试及 UAT 文档更新。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/domains/identity/auth.service.ts

@@ -98,7 +98,18 @@ export class AuthService {
     } else {
       user = await this.prisma.user.findUnique({
         where: { username: username.trim() },
-        include: { auth: true, adminRole: { include: { role: true } } },
+        include: {
+          auth: true,
+          adminRole: {
+            include: {
+              role: {
+                include: {
+                  permissions: { include: { permission: true } },
+                },
+              },
+            },
+          },
+        },
       });
     }
 
@@ -178,6 +189,15 @@ export class AuthService {
 
     const token = this.jwt.sign(payload, { expiresIn });
 
+    const rolePerms = user.adminRole?.role as
+      | { permissions?: Array<{ permission: { code: string } }> }
+      | undefined
+      | null;
+    const adminPermissions =
+      user.userType === 'ADMIN'
+        ? (rolePerms?.permissions?.map((rp) => rp.permission.code) ?? [])
+        : undefined;
+
     return {
       token,
       user: {
@@ -187,6 +207,7 @@ export class AuthService {
         locale: user.locale,
         role: user.adminRole?.role?.code,
         agentLevel: user.userType === 'AGENT' ? user.agentLevel : null,
+        ...(adminPermissions ? { permissions: adminPermissions } : {}),
       },
     };
   }