feat(ECR-013A): Admin RBAC 实现并 Closed

角色权限、RequirePermission、/me permissions 与 migration 000015；
Reviewer Approve → Closed。Next：ECR-013B Contract Definition。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/admin-h5/src/api/client.ts

@@ -94,14 +94,25 @@ export type UserDetail = {
   }>
 }
 
+export type AdminMe = {
+  id: string
+  username: string
+  role?: string
+  permissions: string[]
+}
+
 export const adminApi = {
   login: (username: string, password: string) =>
-    request<{ token: string; admin: { id: string; username: string } }>('POST', '/auth/login', {
+    request<{ token: string; admin: AdminMe }>('POST', '/auth/login', {
       username,
       password,
     }),
   logout: () => request<{ ok: boolean }>('POST', '/auth/logout'),
-  me: () => request<{ id: string; username: string }>('GET', '/me'),
+  me: () => request<AdminMe>('GET', '/me'),
+  roles: () =>
+    request<{ items: Array<{ id: string; name: string; system: boolean }> }>('GET', '/roles'),
+  role: (id: string) =>
+    request<{ id: string; name: string; system: boolean; permissions: string[] }>('GET', `/roles/${id}`),
   stats: () => request<DashboardStats>('GET', '/stats'),
   users: (q = '') =>
     request<{ items: UserListItem[] }>('GET', `/users?q=${encodeURIComponent(q)}`),