feat(db-studio): add gated entry to the database console

Adds 开发工具 → 数据库管理台, which exchanges the admin bearer token for a
single-use entry link (POST /api/admin/v1/internal-surfaces/db-studio/session)
and opens it in a new tab. The link sets an HttpOnly session cookie on the
console's own hostname, so it has to be opened by the browser rather than
fetched — the nginx gate in front of the console then re-checks the permission
on every request.

The tab is opened synchronously inside the click handler, before the request
resolves, or the popup blocker kills it; `noopener` is unusable there since it
makes window.open return null, so the opener is detached manually.

Gated on auth:db-studio:access. That key is `auth:`-prefixed rather than
`admin:` on purpose — PermissionSeeder syncs the admin role to every `admin:%`
key, which would grant database-owner SQL access to every admin account.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/auth/permissions.ts

@@ -31,6 +31,9 @@ export const PERM = {
   NOTIFICATION_READ: 'admin:notification:read',
   ROBOT_TOKEN_ISSUE: 'auth:robot-token:issue',
   API_DOCS_READ: 'auth:api-docs:read',
+  // internal operator consoles — `auth:` prefixed, so super-admin only
+  // (the `admin` role is synced to admin:% keys and would otherwise inherit it)
+  DB_STUDIO_ACCESS: 'auth:db-studio:access',
   // role management — only super-admin holds these
   ROLE_READ: 'auth:role:read',
   ROLE_CREATE: 'auth:role:create',