feat(ECR-010): Ops-E 系统运营；修复登出解绑；P2 Complete

落地管理员 RBAC/封禁/推送任务 stub，logout 解绑 device 并统一各页 ensureAccount，同时收口 P2 生日生成与状态文档。

Co-authored-by: Cursor <cursoragent@cursor.com>

proto/openapi.yaml

@@ -74,10 +74,10 @@ paths:
   /api/v1/admin/me:
     get:
       tags: [admin]
-      summary: Current admin
+      summary: Current admin (includes role)
       responses:
         '200':
-          description: OK
+          description: OK (id, username, role)
 
   /api/v1/admin/users:
     get:
@@ -131,6 +131,106 @@ paths:
       responses:
         '200':
           description: OK
+        '403':
+          description: Forbidden (ops role)
+
+  /api/v1/admin/users/{id}/ban:
+    post:
+      tags: [admin]
+      summary: Ban user (Ops-E)
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { type: string, format: uuid }
+      responses:
+        '200':
+          description: OK
+
+  /api/v1/admin/users/{id}/unban:
+    post:
+      tags: [admin]
+      summary: Unban user (Ops-E)
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { type: string, format: uuid }
+      responses:
+        '200':
+          description: OK
+
+  /api/v1/admin/admins:
+    get:
+      tags: [admin]
+      summary: List admin accounts (super only)
+      responses:
+        '200':
+          description: OK
+        '403':
+          description: Forbidden
+
+  /api/v1/admin/admins/{id}:
+    patch:
+      tags: [admin]
+      summary: Update admin role (super only)
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { type: string, format: uuid }
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [role]
+              properties:
+                role: { type: string, enum: [super, ops] }
+      responses:
+        '200':
+          description: OK
+        '409':
+          description: Cannot demote last super
+
+  /api/v1/admin/push-jobs:
+    get:
+      tags: [admin]
+      summary: List push job stubs (Ops-E)
+      responses:
+        '200':
+          description: OK
+    post:
+      tags: [admin]
+      summary: Create push draft (no dispatch)
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [title]
+              properties:
+                title: { type: string }
+                body: { type: string }
+                audience: { type: string }
+      responses:
+        '200':
+          description: OK
+
+  /api/v1/admin/push-jobs/{id}:
+    patch:
+      tags: [admin]
+      summary: Update push stub (draft or cancelled)
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { type: string, format: uuid }
+      responses:
+        '200':
+          description: OK
 
   /api/v1/admin/orders:
     get: