feat(ECR-010): Ops-E 系统运营；修复登出解绑；P2 Complete

落地管理员 RBAC/封禁/推送任务 stub，logout 解绑 device 并统一各页 ensureAccount，同时收口 P2 生日生成与状态文档。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/handler/admin_content.go

@@ -43,6 +43,10 @@ func (h *AdminHandler) ReplaceHomeTools(c *gin.Context) {
 		return
 	}
 	if err := h.Svc.ReplaceHomeTools(c.Request.Context(), adminID, body.Items); err != nil {
+		if errors.Is(err, admin.ErrForbidden) {
+			response.Fail(c, http.StatusForbidden, 40301, "forbidden")
+			return
+		}
 		if errors.Is(err, homesvc.ErrInvalidTools) || errors.Is(err, homesvc.ErrTooManyTools) {
 			response.Fail(c, http.StatusBadRequest, 40041, err.Error())
 			return
@@ -81,6 +85,10 @@ func (h *AdminHandler) PatchScale(c *gin.Context) {
 		return
 	}
 	if err := h.Svc.PatchScaleStatus(c.Request.Context(), adminID, id, body.Status); err != nil {
+		if errors.Is(err, admin.ErrForbidden) {
+			response.Fail(c, http.StatusForbidden, 40301, "forbidden")
+			return
+		}
 		if errors.Is(err, admin.ErrInvalidScaleStatus) {
 			response.Fail(c, http.StatusBadRequest, 40044, "invalid status")
 			return