feat(ECR-010): Ops-E 系统运营；修复登出解绑；P2 Complete

落地管理员 RBAC/封禁/推送任务 stub，logout 解绑 device 并统一各页 ensureAccount，同时收口 P2 生日生成与状态文档。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/repository/admin_repo.go

@@ -23,6 +23,7 @@ type AdminAccount struct {
 	Username     string
 	PasswordHash string
 	Status       string
+	Role         string
 }
 
 // CountAccounts returns non-deleted admin count.
@@ -33,12 +34,12 @@ func (r *AdminRepo) CountAccounts(ctx context.Context) (int, error) {
 	return n, err
 }
 
-// CreateAccount inserts an admin account.
+// CreateAccount inserts an admin account (role defaults to super).
 func (r *AdminRepo) CreateAccount(ctx context.Context, username, hash string) (uuid.UUID, error) {
 	var id uuid.UUID
 	err := r.Pool.QueryRow(ctx, `
-		INSERT INTO admin_accounts(username, password_hash)
-		VALUES ($1,$2) RETURNING id`, username, hash).Scan(&id)
+		INSERT INTO admin_accounts(username, password_hash, role)
+		VALUES ($1,$2,'super') RETURNING id`, username, hash).Scan(&id)
 	return id, err
 }
 
@@ -46,10 +47,10 @@ func (r *AdminRepo) CreateAccount(ctx context.Context, username, hash string) (u
 func (r *AdminRepo) FindByUsername(ctx context.Context, username string) (*AdminAccount, error) {
 	var a AdminAccount
 	err := r.Pool.QueryRow(ctx, `
-		SELECT id, username, password_hash, status
+		SELECT id, username, password_hash, status, role
 		FROM admin_accounts
 		WHERE username=$1 AND deleted_at IS NULL`, username,
-	).Scan(&a.ID, &a.Username, &a.PasswordHash, &a.Status)
+	).Scan(&a.ID, &a.Username, &a.PasswordHash, &a.Status, &a.Role)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, nil
 	}
@@ -63,10 +64,10 @@ func (r *AdminRepo) FindByUsername(ctx context.Context, username string) (*Admin
 func (r *AdminRepo) FindAccountByID(ctx context.Context, id uuid.UUID) (*AdminAccount, error) {
 	var a AdminAccount
 	err := r.Pool.QueryRow(ctx, `
-		SELECT id, username, password_hash, status
+		SELECT id, username, password_hash, status, role
 		FROM admin_accounts
 		WHERE id=$1 AND deleted_at IS NULL`, id,
-	).Scan(&a.ID, &a.Username, &a.PasswordHash, &a.Status)
+	).Scan(&a.ID, &a.Username, &a.PasswordHash, &a.Status, &a.Role)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, nil
 	}