fix(admin): 收紧 isSuper、plan-prices RBAC 与封禁状态机

避免 roles.write 绕过全部 can()；定价读写挂 membership.plans 权限；去掉快捷封禁双路径并让 ban/unban 走 lifecycle。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/admin-h5/src/api/client.ts

@@ -148,8 +148,6 @@ export const adminApi = {
   users: (q = '') =>
     request<{ items: UserListItem[] }>('GET', `/users?q=${encodeURIComponent(q)}`),
   user: (id: string) => request<UserDetail>('GET', `/users/${id}`),
-  banUser: (id: string) => request<{ ok: boolean }>('POST', `/users/${id}/ban`),
-  unbanUser: (id: string) => request<{ ok: boolean }>('POST', `/users/${id}/unban`),
   setUserStatus: (id: string, status: string, reason: string) =>
     request<UserDetail>('POST', `/users/${id}/status`, { status, reason }),
   statusTransitions: (id: string) =>