fix(admin): 收紧 isSuper、plan-prices RBAC 与封禁状态机

避免 roles.write 绕过全部 can()；定价读写挂 membership.plans 权限；去掉快捷封禁双路径并让 ban/unban 走 lifecycle。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/integration/ops_system_test.go

@@ -188,9 +188,26 @@ func insertOpsAdmin(t *testing.T, username, password string) {
 	if err != nil {
 		t.Fatalf("hash: %v", err)
 	}
+	var roleID uuid.UUID
+	err = pool.QueryRow(ctx, `
+		INSERT INTO admin_roles(name, system)
+		VALUES ('ops', false)
+		ON CONFLICT (name) DO UPDATE SET name = EXCLUDED.name
+		RETURNING id`).Scan(&roleID)
+	if err != nil {
+		t.Fatalf("ensure ops role: %v", err)
+	}
 	_, err = pool.Exec(ctx, `
-		INSERT INTO admin_accounts(username, password_hash, role, status)
-		VALUES ($1,$2,'ops','active')`, username, string(hash))
+		INSERT INTO admin_role_permissions(role_id, code) VALUES
+			($1, 'admin.users.read'),
+			($1, 'admin.users.status.write')
+		ON CONFLICT DO NOTHING`, roleID)
+	if err != nil {
+		t.Fatalf("ops role perms: %v", err)
+	}
+	_, err = pool.Exec(ctx, `
+		INSERT INTO admin_accounts(username, password_hash, role, status, role_id)
+		VALUES ($1,$2,'ops','active',$3)`, username, string(hash), roleID)
 	if err != nil {
 		t.Fatalf("insert ops admin: %v", err)
 	}