feat(auth): wire permission gating through menu, routes and actions

The store's can()/useCan() helpers existed but were unused. Now:
- src/auth/permissions.ts PERM catalog mirrors backend keys
- every nav item carries a permission; sidebar filter reuses can()
- requirePermission() beforeLoad guard on all child routes (direct URLs
  redirect home when the session lacks the key)
- useCan() hides/disables mutation buttons: moderation actions,
  retranslate, robot-author edit/pause, category + locale CRUD, and the
  reserved-SID assign path (admin:sid:override hint)
- 403 responses toast 无权限执行此操作; can() unit tests added

Co-Authored-By: Claude Fable 5 <[email protected]>

src/components/layout/nav.ts

@@ -1,7 +1,9 @@
 import type { LucideIcon } from 'lucide-react'
 import {
+  BookOpenText,
   Bot,
   ClipboardList,
+  FileText,
   Flag,
   FolderTree,
   Hash,
@@ -16,9 +18,11 @@ import {
   Receipt,
   ScrollText,
   Send,
+  Shield,
   Smartphone,
   Sparkles,
   UserCheck,
+  Users,
 } from 'lucide-react'
 
 export interface NavItem {
@@ -38,19 +42,19 @@ export const NAV_GROUPS: NavGroup[] = [
   {
     label: '分类管理',
     items: [
-      { label: '分类树', to: '/categories', icon: FolderTree },
-      { label: '待审核分类', to: '/categories/pending', icon: ListChecks },
+      { label: '分类树', to: '/categories', icon: FolderTree, permission: 'admin:category:read' },
+      { label: '待审核分类', to: '/categories/pending', icon: ListChecks, permission: 'admin:category:approve' },
     ],
   },
   {
     label: '内容工作室',
     items: [
-      { label: '机器人作者', to: '/studio/robot-authors', icon: Bot },
-      { label: '文章系列', to: '/studio/series', icon: LayoutList },
-      { label: '文章', to: '/studio/articles', icon: Newspaper },
-      { label: '子话题', to: '/studio/subtopics', icon: Sparkles },
-      { label: '分类简报', to: '/studio/category-briefs', icon: ScrollText },
-      { label: '风格预设', to: '/studio/style-presets', icon: Palette },
+      { label: '机器人作者', to: '/studio/robot-authors', icon: Bot, permission: 'admin:studio:read' },
+      { label: '文章系列', to: '/studio/series', icon: LayoutList, permission: 'admin:studio:read' },
+      { label: '文章', to: '/studio/articles', icon: Newspaper, permission: 'admin:studio:read' },
+      { label: '子话题', to: '/studio/subtopics', icon: Sparkles, permission: 'admin:studio:read' },
+      { label: '分类简报', to: '/studio/category-briefs', icon: ScrollText, permission: 'admin:studio:read' },
+      { label: '风格预设', to: '/studio/style-presets', icon: Palette, permission: 'admin:studio:read' },
       {
         label: 'Agent 接入',
         to: '/studio/agent-tokens',
@@ -62,27 +66,36 @@ export const NAV_GROUPS: NavGroup[] = [
   {
     label: '专长交易',
     items: [
-      { label: '需求监控', to: '/exc/demands', icon: ClipboardList },
-      { label: '派单监控', to: '/exc/dispatches', icon: Send },
-      { label: '订单监控', to: '/exc/orders', icon: Receipt },
-      { label: '服务商监控', to: '/exc/providers', icon: UserCheck },
+      { label: '需求监控', to: '/exc/demands', icon: ClipboardList, permission: 'admin:exc:read' },
+      { label: '派单监控', to: '/exc/dispatches', icon: Send, permission: 'admin:exc:read' },
+      { label: '订单监控', to: '/exc/orders', icon: Receipt, permission: 'admin:exc:read' },
+      { label: '服务商监控', to: '/exc/providers', icon: UserCheck, permission: 'admin:exc:read' },
+    ],
+  },
+  {
+    label: 'Dimzou 内容',
+    items: [
+      { label: '文档监控', to: '/dimzou/documents', icon: FileText, permission: 'admin:dimzou:read' },
+      { label: '发布监控', to: '/dimzou/publications', icon: BookOpenText, permission: 'admin:dimzou:read' },
+      { label: 'Dimzou 翻译', to: '/dimzou-translations', icon: Languages, permission: 'admin:dimzou:read' },
     ],
   },
   {
     label: '内容审核',
     items: [
-      { label: '被举报评论', to: '/comment-reports', icon: MessageSquareWarning },
-      { label: '被举报事件', to: '/event-reports', icon: Flag },
-      { label: 'Dimzou 翻译', to: '/dimzou-translations', icon: Languages },
+      { label: '被举报评论', to: '/comment-reports', icon: MessageSquareWarning, permission: 'admin:comment:read' },
+      { label: '被举报事件', to: '/event-reports', icon: Flag, permission: 'admin:filex:read' },
     ],
   },
   {
     label: '用户与系统',
     items: [
-      { label: 'SID 管理', to: '/sid', icon: Hash },
-      { label: '语言设置', to: '/locales', icon: Languages },
-      { label: '推送设备', to: '/devices', icon: Smartphone },
-      { label: '机器人会话', to: '/robots', icon: Inbox },
+      { label: '角色管理', to: '/roles', icon: Shield, permission: 'auth:role:read' },
+      { label: '用户角色', to: '/admin-users', icon: Users, permission: 'auth:role:assign' },
+      { label: 'SID 管理', to: '/sid', icon: Hash, permission: 'admin:sid:manage' },
+      { label: '语言设置', to: '/locales', icon: Languages, permission: 'admin:locale:read' },
+      { label: '推送设备', to: '/devices', icon: Smartphone, permission: 'admin:notification:read' },
+      { label: '机器人会话', to: '/robots', icon: Inbox, permission: 'auth:robot-token:issue' },
     ],
   },
 ]