feat(ECR-013A): Admin RBAC 实现并 Closed

角色权限、RequirePermission、/me permissions 与 migration 000015；
Reviewer Approve → Closed。Next：ECR-013B Contract Definition。

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/HANDOFF/ECR-013A-engineer-to-reviewer.md

@@ -0,0 +1,19 @@
+# HANDOFF — ECR-013A Engineer → Reviewer
+
+## Done
+
+- Migration `000015_admin_rbac`：roles / permissions / `admin_accounts.role_id` + 种子 `super_admin`
+- Middleware `RequireAdminPermission`；既有 admin 读写路由挂权限
+- API：`GET /roles` · `GET /roles/:id` · `PUT /roles/:id/permissions`；`GET /me` + login 返回 `role` + `permissions[]`
+- OpenAPI + admin-h5 me/store 最小展示
+- Integration `TestAdminRBAC` 映射 AC-F/S/P/O
+- `docs/TEST_REPORT/ECR-013A.md`
+
+## Evidence
+
+`docs/TEST_REPORT/ECR-013A.md` · Spec `.ai/product/feature-spec/ops-rbac.md`
+
+## Ask
+
+Reviewer 勾选 `docs/CODE_REVIEW/ECR-013A.md`；Approve 后可将 ECR-013A 标 Closed。  
+**勿自动启动 ECR-013B**（需另次 Human Start Authorization）。