feat(ECR-014): MembershipPlan 套餐配置并 Closed

membership_plans 表、admin 套餐页、Grant/CreateOrder 读表；
Loop continuous 自动 Approve/Closed。Next：ECR-015 RedemptionCode。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/service/admin/rbac.go

@@ -10,23 +10,25 @@ import (
 
 // Permission catalog frozen in ECR-013A Spec.
 const (
-	PermUsersRead         = "admin.users.read"
-	PermMembershipGrant   = "admin.users.membership.grant"
-	PermAskQuotaGrant     = "admin.users.ask_quota.grant"
-	PermOrdersRead        = "admin.orders.read"
-	PermAuditRead         = "admin.audit.read"
-	PermAnalyticsRead     = "admin.analytics.read"
-	PermContentWrite      = "admin.content.write"
-	PermRolesRead         = "admin.roles.read"
-	PermRolesWrite        = "admin.roles.write"
-	PermUsersStatusWrite  = "admin.users.status.write"
+	PermUsersRead            = "admin.users.read"
+	PermMembershipGrant      = "admin.users.membership.grant"
+	PermAskQuotaGrant        = "admin.users.ask_quota.grant"
+	PermOrdersRead           = "admin.orders.read"
+	PermAuditRead            = "admin.audit.read"
+	PermAnalyticsRead        = "admin.analytics.read"
+	PermContentWrite         = "admin.content.write"
+	PermRolesRead            = "admin.roles.read"
+	PermRolesWrite           = "admin.roles.write"
+	PermUsersStatusWrite     = "admin.users.status.write"
+	PermMembershipPlansRead  = "admin.membership.plans.read"
+	PermMembershipPlansWrite = "admin.membership.plans.write"
 )
 
 var knownPermissions = map[string]struct{}{
 	PermUsersRead: {}, PermMembershipGrant: {}, PermAskQuotaGrant: {},
 	PermOrdersRead: {}, PermAuditRead: {}, PermAnalyticsRead: {},
 	PermContentWrite: {}, PermRolesRead: {}, PermRolesWrite: {},
-	PermUsersStatusWrite: {},
+	PermUsersStatusWrite: {}, PermMembershipPlansRead: {}, PermMembershipPlansWrite: {},
 }
 
 var (