feat(ECR-013A): Admin RBAC 实现并 Closed

角色权限、RequirePermission、/me permissions 与 migration 000015；
Reviewer Approve → Closed。Next：ECR-013B Contract Definition。

Co-authored-by: Cursor <cursoragent@cursor.com>

proto/openapi.yaml

@@ -74,10 +74,73 @@ paths:
   /api/v1/admin/me:
     get:
       tags: [admin]
-      summary: Current admin
+      summary: Current admin (role + permissions[])
       responses:
         '200':
           description: OK
+          content:
+            application/json:
+              schema:
+                allOf:
+                  - $ref: '#/components/schemas/Envelope'
+                  - type: object
+                    properties:
+                      data:
+                        $ref: '#/components/schemas/AdminMe'
+
+  /api/v1/admin/roles:
+    get:
+      tags: [admin]
+      summary: List admin roles
+      description: Requires admin.roles.read
+      responses:
+        '200':
+          description: OK
+        '403':
+          description: Forbidden
+
+  /api/v1/admin/roles/{id}:
+    get:
+      tags: [admin]
+      summary: Role detail with permissions
+      description: Requires admin.roles.read
+      parameters:
+        - $ref: '#/components/parameters/Id'
+      responses:
+        '200':
+          description: OK
+        '403':
+          description: Forbidden
+        '404':
+          description: Not found
+
+  /api/v1/admin/roles/{id}/permissions:
+    put:
+      tags: [admin]
+      summary: Replace role permission set
+      description: Requires admin.roles.write; writes AuditLog
+      parameters:
+        - $ref: '#/components/parameters/Id'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [permissions]
+              properties:
+                permissions:
+                  type: array
+                  items: { type: string }
+      responses:
+        '200':
+          description: OK
+        '400':
+          description: Invalid permission code
+        '403':
+          description: Forbidden
+        '404':
+          description: Not found
 
   /api/v1/admin/users:
     get:
@@ -887,6 +950,17 @@ components:
         message: { type: string, example: success }
         data: { type: object }
 
+    AdminMe:
+      type: object
+      required: [id, username, permissions]
+      properties:
+        id: { type: string, format: uuid }
+        username: { type: string }
+        role: { type: string }
+        permissions:
+          type: array
+          items: { type: string }
+
     CreateProfileRequest:
       type: object
       required: [relation, birth_date]