feat(ECR-013A): Admin RBAC 实现并 Closed

角色权限、RequirePermission、/me permissions 与 migration 000015；
Reviewer Approve → Closed。Next：ECR-013B Contract Definition。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/admin-h5/src/stores/auth.ts

@@ -5,19 +5,27 @@ import { adminApi, getToken, setToken } from '@/api/client'
 export const useAuthStore = defineStore('auth', () => {
   const token = ref<string | null>(getToken())
   const username = ref<string>('')
+  const role = ref<string>('')
+  const permissions = ref<string[]>([])
+
+  function applyMe(me: { username: string; role?: string; permissions?: string[] }) {
+    username.value = me.username
+    role.value = me.role || ''
+    permissions.value = me.permissions ?? []
+  }
 
   async function login(user: string, password: string) {
     const res = await adminApi.login(user, password)
     setToken(res.token)
     token.value = res.token
-    username.value = res.admin.username
+    applyMe(res.admin)
   }
 
   async function hydrate() {
     if (!token.value) return false
     try {
       const me = await adminApi.me()
-      username.value = me.username
+      applyMe(me)
       return true
     } catch {
       setToken(null)
@@ -35,7 +43,13 @@ export const useAuthStore = defineStore('auth', () => {
     setToken(null)
     token.value = null
     username.value = ''
+    role.value = ''
+    permissions.value = []
   }
 
-  return { token, username, login, logout, hydrate }
+  function can(code: string) {
+    return permissions.value.includes(code)
+  }
+
+  return { token, username, role, permissions, can, login, logout, hydrate }
 })