feat(ECR-013A): Admin RBAC 实现并 Closed

角色权限、RequirePermission、/me permissions 与 migration 000015；
Reviewer Approve → Closed。Next：ECR-013B Contract Definition。

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/HANDOFF/ECR-013A-architect-to-engineer.md

@@ -0,0 +1,31 @@
+# HANDOFF — ECR-013A Architect → Engineer
+
+## Gate
+
+**Parent:** WAVE0-FROZEN (`27f27a1`)
+
+**ECR-013A + BD-2026-013A = Approved（2026-08-07 Human）**  
+**Coding Start Authorization: 2026-08-07（Human）→ Engineer 可改 `apps/`。**
+
+## Consume
+
+1. `.ai/product/feature-spec/ops-rbac.md`  
+2. ECR / PRODUCT / ENGINEERING / BD / `docs/CONTRACT_DIFF/ECR-013A.yaml`  
+3. `.ai/domain/boundary-rules.md` · `glossary.yaml`  
+
+## Do
+
+按 ENGINEERING_SPEC Implement order。
+
+## Do not
+
+- UserStatus / ECR-013B  
+- 真支付 · UGC · Prompt  
+- 跳过 Security AC  
+
+## Return
+
+1. HANDOFF engineer→reviewer  
+2. TEST_REPORT 映射全部 AC-ID  
+3. CODE_REVIEW  
+4. `ess-validate --phase review --ecr ECR-013A`