feat(ECR-024): OpsCMS Banner 只读并 Closed

运营横幅目录（ops_banners + admin /cms），锁定 024–040 全队列。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/service/admin/rbac.go

@@ -29,6 +29,7 @@ const (
 	PermContentSafetyRead    = "admin.content_safety.read"
 	PermAIConfigRead         = "admin.ai_config.read"
 	PermCrisisRead           = "admin.crisis.read"
+	PermCMSRead              = "admin.cms.read"
 )
 
 var knownPermissions = map[string]struct{}{
@@ -38,7 +39,7 @@ var knownPermissions = map[string]struct{}{
 	PermUsersStatusWrite: {}, PermMembershipPlansRead: {}, PermMembershipPlansWrite: {},
 	PermMembershipCodesRead: {}, PermMembershipCodesWrite: {},
 	PermAskRead: {}, PermAskFeedbackWrite: {}, PermContentSafetyRead: {},
-	PermAIConfigRead: {}, PermCrisisRead: {},
+	PermAIConfigRead: {}, PermCrisisRead: {}, PermCMSRead: {},
 }
 
 var (