feat(ECR-010): Ops-E 系统运营；修复登出解绑；P2 Complete

落地管理员 RBAC/封禁/推送任务 stub，logout 解绑 device 并统一各页 ensureAccount，同时收口 P2 生日生成与状态文档。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/service/admin/service.go

@@ -58,6 +58,7 @@ type LoginResult struct {
 type AdminMe struct {
 	ID       uuid.UUID `json:"id"`
 	Username string    `json:"username"`
+	Role     string    `json:"role"`
 }
 
 var (
@@ -93,7 +94,7 @@ func (s *Service) Login(ctx context.Context, username, password string) (*LoginR
 	return &LoginResult{
 		Token:     token,
 		ExpiresAt: exp,
-		Admin:     AdminMe{ID: acc.ID, Username: acc.Username},
+		Admin:     AdminMe{ID: acc.ID, Username: acc.Username, Role: acc.Role},
 	}, nil
 }
 
@@ -116,7 +117,7 @@ func (s *Service) Me(ctx context.Context, adminID uuid.UUID) (*AdminMe, error) {
 	if err != nil || acc == nil {
 		return nil, errors.New("admin not found")
 	}
-	return &AdminMe{ID: acc.ID, Username: acc.Username}, nil
+	return &AdminMe{ID: acc.ID, Username: acc.Username, Role: acc.Role}, nil
 }
 
 // ListUsers lists terminal users.
@@ -197,6 +198,9 @@ type GrantInput struct {
 
 // GrantMembership extends membership and writes audit.
 func (s *Service) GrantMembership(ctx context.Context, adminID, userID uuid.UUID, plan string) error {
+	if err := s.RequireSuper(ctx, adminID); err != nil {
+		return err
+	}
 	days, err := planDays(plan)
 	if err != nil {
 		return err
@@ -221,6 +225,9 @@ var ErrInvalidAskDelta = errString("invalid ask quota delta")
 
 // GrantAskQuota adds purchased ask quota and audits.
 func (s *Service) GrantAskQuota(ctx context.Context, adminID, userID uuid.UUID, delta int) (int, error) {
+	if err := s.RequireSuper(ctx, adminID); err != nil {
+		return 0, err
+	}
 	if delta <= 0 || delta > 1000 {
 		return 0, ErrInvalidAskDelta
 	}
@@ -247,6 +254,9 @@ func (s *Service) ListPlanPrices(ctx context.Context) ([]repository.PlanPrice, e
 
 // UpsertPlanPrices updates display prices (not historical order amounts).
 func (s *Service) UpsertPlanPrices(ctx context.Context, adminID uuid.UUID, items []repository.PlanPrice) error {
+	if err := s.RequireSuper(ctx, adminID); err != nil {
+		return err
+	}
 	if len(items) == 0 {
 		return ErrInvalidPlan
 	}