feat: 实现完整的板块级RBAC内容审核系统

- 新增站长/超级管理员/管理员/板块管理员四级角色体系
- 实现实时权限快照加载与细粒度权限校验
- 新增内容审核队列与前后端页面
- 重构用户权限管理与站点管理逻辑
- 新增评论/帖子审核状态与通知推送
- 优化前端权限控制与角色徽章展示
- 修正数据库迁移与默认值问题

frontend/app/admin/users/page.tsx

@@ -3,6 +3,8 @@ import { cookies } from "next/headers";
 import { authCookieHeader } from "@/lib/cookies";
 import { fetchAdminUsers, type AdminUsersResponse } from "@/lib/api";
 import { getMeCached } from "@/lib/serverData";
+import { isSuperOrOwner } from "@/lib/roles";
+import Forbidden from "../Forbidden";
 import UsersAdmin, { type UserFilter } from "./UsersAdmin";
 
 export const metadata: Metadata = {
@@ -13,9 +15,9 @@ interface UsersPageProps {
   searchParams: Promise<{ q?: string; filter?: string; page?: string }>;
 }
 
-// 筛选项映射为后端查询参数：管理员走 role，封禁走 status，其余不过滤
+// 筛选项映射为后端查询参数：管理团队走 role=staff，封禁走 status，其余不过滤
 function filterToQuery(filter: UserFilter): { role?: string; status?: string } {
-  if (filter === "admin") return { role: "admin" };
+  if (filter === "staff") return { role: "staff" };
   if (filter === "banned") return { status: "banned" };
   return {};
 }
@@ -24,12 +26,17 @@ function filterToQuery(filter: UserFilter): { role?: string; status?: string } {
 export default async function AdminUsersPage({ searchParams }: UsersPageProps) {
   const sp = await searchParams;
   const q = sp.q?.trim() || "";
-  const filter: UserFilter = sp.filter === "admin" || sp.filter === "banned" ? sp.filter : "all";
+  const filter: UserFilter = sp.filter === "staff" || sp.filter === "banned" ? sp.filter : "all";
   const page = Math.max(1, parseInt(sp.page || "1", 10) || 1);
 
   const cookie = authCookieHeader(await cookies());
   const me = await getMeCached(cookie || undefined);
 
+  // 仅超级管理员与站长可管理用户与角色
+  if (!me.user || !isSuperOrOwner(me.user.role)) {
+    return <Forbidden text="用户与角色权限仅超级管理员和站长可操作。" />;
+  }
+
   let initial: AdminUsersResponse | null = null;
   let initError = "";
   try {
@@ -44,6 +51,7 @@ export default async function AdminUsersPage({ searchParams }: UsersPageProps) {
       initError={initError}
       initialQuery={{ q, filter, page }}
       currentUserId={me.user?.id ?? 0}
+      currentUserRole={me.user?.role ?? ""}
     />
   );
 }