feat(ECR-013A): Admin RBAC 实现并 Closed

角色权限、RequirePermission、/me permissions 与 migration 000015；
Reviewer Approve → Closed。Next：ECR-013B Contract Definition。

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/HANDOFF/ECR-013A-architect-to-engineer.md

@@ -0,0 +1,31 @@
+# HANDOFF — ECR-013A Architect → Engineer
+
+## Gate
+
+**Parent:** WAVE0-FROZEN (`27f27a1`)
+
+**ECR-013A + BD-2026-013A = Approved（2026-08-07 Human）**  
+**Coding Start Authorization: 2026-08-07（Human）→ Engineer 可改 `apps/`。**
+
+## Consume
+
+1. `.ai/product/feature-spec/ops-rbac.md`  
+2. ECR / PRODUCT / ENGINEERING / BD / `docs/CONTRACT_DIFF/ECR-013A.yaml`  
+3. `.ai/domain/boundary-rules.md` · `glossary.yaml`  
+
+## Do
+
+按 ENGINEERING_SPEC Implement order。
+
+## Do not
+
+- UserStatus / ECR-013B  
+- 真支付 · UGC · Prompt  
+- 跳过 Security AC  
+
+## Return
+
+1. HANDOFF engineer→reviewer  
+2. TEST_REPORT 映射全部 AC-ID  
+3. CODE_REVIEW  
+4. `ess-validate --phase review --ecr ECR-013A`  

docs/HANDOFF/ECR-013A-engineer-to-reviewer.md

@@ -0,0 +1,19 @@
+# HANDOFF — ECR-013A Engineer → Reviewer
+
+## Done
+
+- Migration `000015_admin_rbac`：roles / permissions / `admin_accounts.role_id` + 种子 `super_admin`
+- Middleware `RequireAdminPermission`；既有 admin 读写路由挂权限
+- API：`GET /roles` · `GET /roles/:id` · `PUT /roles/:id/permissions`；`GET /me` + login 返回 `role` + `permissions[]`
+- OpenAPI + admin-h5 me/store 最小展示
+- Integration `TestAdminRBAC` 映射 AC-F/S/P/O
+- `docs/TEST_REPORT/ECR-013A.md`
+
+## Evidence
+
+`docs/TEST_REPORT/ECR-013A.md` · Spec `.ai/product/feature-spec/ops-rbac.md`
+
+## Ask
+
+Reviewer 勾选 `docs/CODE_REVIEW/ECR-013A.md`；Approve 后可将 ECR-013A 标 Closed。  
+**勿自动启动 ECR-013B**（需另次 Human Start Authorization）。