feat(ECR-010): Ops-E 系统运营；修复登出解绑；P2 Complete

落地管理员 RBAC/封禁/推送任务 stub，logout 解绑 device 并统一各页 ensureAccount，同时收口 P2 生日生成与状态文档。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/migrations/000016_ops_system.down.sql

@@ -0,0 +1,7 @@
+DROP INDEX IF EXISTS idx_push_jobs_created;
+DROP TABLE IF EXISTS push_jobs;
+
+ALTER TABLE users DROP CONSTRAINT IF EXISTS users_status_check;
+
+ALTER TABLE admin_accounts DROP CONSTRAINT IF EXISTS admin_accounts_role_check;
+ALTER TABLE admin_accounts DROP COLUMN IF EXISTS role;

apps/api/migrations/000016_ops_system.up.sql

@@ -0,0 +1,34 @@
+-- Ops-E: RBAC role · user status check · push_jobs stub
+
+ALTER TABLE admin_accounts
+  ADD COLUMN IF NOT EXISTS role varchar(16) NOT NULL DEFAULT 'super';
+
+ALTER TABLE admin_accounts
+  DROP CONSTRAINT IF EXISTS admin_accounts_role_check;
+
+ALTER TABLE admin_accounts
+  ADD CONSTRAINT admin_accounts_role_check
+  CHECK (role IN ('super', 'ops'));
+
+UPDATE admin_accounts SET role = 'super' WHERE role IS NULL OR role = '';
+
+ALTER TABLE users
+  DROP CONSTRAINT IF EXISTS users_status_check;
+
+ALTER TABLE users
+  ADD CONSTRAINT users_status_check
+  CHECK (status IN ('active', 'banned'));
+
+CREATE TABLE IF NOT EXISTS push_jobs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  title varchar(128) NOT NULL,
+  body text NOT NULL DEFAULT '',
+  audience varchar(64) NOT NULL DEFAULT 'all',
+  status varchar(32) NOT NULL DEFAULT 'draft',
+  created_by uuid NOT NULL REFERENCES admin_accounts(id),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT push_jobs_status_check CHECK (status IN ('draft', 'cancelled'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_push_jobs_created ON push_jobs(created_at DESC);