feat(ECR-010): Ops-E 系统运营；修复登出解绑；P2 Complete

落地管理员 RBAC/封禁/推送任务 stub，logout 解绑 device 并统一各页 ensureAccount，同时收口 P2 生日生成与状态文档。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/handler/admin.go

@@ -45,6 +45,7 @@ func (h *AdminHandler) Register(api *gin.RouterGroup) {
 	authed.GET("/analytics/clicks", h.AnalyticsClicks)
 	authed.GET("/analytics/funnel", h.AnalyticsFunnel)
 	h.registerContent(authed)
+	h.registerSystem(authed)
 }
 
 func (h *AdminHandler) Login(c *gin.Context) {
@@ -143,6 +144,10 @@ func (h *AdminHandler) GrantMembership(c *gin.Context) {
 		return
 	}
 	if err := h.Svc.GrantMembership(c.Request.Context(), adminID, userID, body.Plan); err != nil {
+		if errors.Is(err, admin.ErrForbidden) {
+			response.Fail(c, http.StatusForbidden, 40301, "forbidden")
+			return
+		}
 		if errors.Is(err, admin.ErrInvalidPlan) {
 			response.Fail(c, http.StatusBadRequest, 40004, "invalid plan")
 			return
@@ -175,6 +180,10 @@ func (h *AdminHandler) GrantAskQuota(c *gin.Context) {
 	}
 	left, err := h.Svc.GrantAskQuota(c.Request.Context(), adminID, userID, body.Delta)
 	if err != nil {
+		if errors.Is(err, admin.ErrForbidden) {
+			response.Fail(c, http.StatusForbidden, 40301, "forbidden")
+			return
+		}
 		if errors.Is(err, admin.ErrInvalidAskDelta) {
 			response.Fail(c, http.StatusBadRequest, 40006, "invalid delta")
 			return
@@ -239,6 +248,10 @@ func (h *AdminHandler) PutPlanPrices(c *gin.Context) {
 		prices = append(prices, repository.PlanPrice{Plan: it.Plan, DisplayCents: it.DisplayCents})
 	}
 	if err := h.Svc.UpsertPlanPrices(c.Request.Context(), adminID, prices); err != nil {
+		if errors.Is(err, admin.ErrForbidden) {
+			response.Fail(c, http.StatusForbidden, 40301, "forbidden")
+			return
+		}
 		response.Fail(c, http.StatusBadRequest, 40041, "upsert plan prices failed")
 		return
 	}