fix(admin): 收紧 isSuper、plan-prices RBAC 与封禁状态机

避免 roles.write 绕过全部 can()；定价读写挂 membership.plans 权限；去掉快捷封禁双路径并让 ban/unban 走 lifecycle。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/admin-h5/src/pages/UserDetailPage.vue

@@ -125,22 +125,6 @@ async function changeStatus() {
   }
 }
 
-async function toggleBan() {
-  statusMsg.value = ''
-  try {
-    if (detail.value?.status === 'banned') {
-      await adminApi.unbanUser(String(route.params.id))
-      statusMsg.value = '已解封'
-    } else {
-      await adminApi.banUser(String(route.params.id))
-      statusMsg.value = '已封禁'
-    }
-    await load()
-  } catch (e) {
-    statusMsg.value = e instanceof Error ? e.message : '操作失败'
-  }
-}
-
 function fmtTime(iso?: string | null) {
   if (!iso) return '—'
   try {
@@ -194,9 +178,6 @@ onMounted(load)
             </select>
             <input v-model="statusReason" class="reason" type="text" placeholder="原因（必填）" />
             <button class="btn" type="button" @click="changeStatus">变更状态</button>
-            <button class="btn ghost" type="button" @click="toggleBan">
-              {{ detail.status === 'banned' ? '快捷解封' : '快捷封禁' }}
-            </button>
             <span v-if="statusMsg" class="muted">{{ statusMsg }}</span>
           </div>
           <div v-if="transitions.length" class="trans">