feat: 权限与日志治理完善，MinIO 独立部署与 tiktoken 离线打包适配

- 后端：强化平台/审批/资源/系统接口权限校验与操作日志，更新权限设计文档与测试用例
- 存储：新增 MinIO 独立部署适配（端口 19000/19001），外部端点与 host-gateway 互通
- 离线：打包 tiktoken cl100k_base 词表进镜像，避免无网环境联网下载
- 其他：算力节点接口微调，前端微调创建页小修，忽略 MinIO 运行时数据

Co-Authored-By: Claude <noreply@anthropic.com>

backend/app/db/sql/000_full_init.sql

@@ -64,7 +64,12 @@ CREATE TABLE IF NOT EXISTS models (
     api_key TEXT,
     online_model_name TEXT,
     can_train INTEGER NOT NULL DEFAULT 0,
-    create_time TEXT NOT NULL
+    create_time TEXT NOT NULL,
+    created_by TEXT,
+    tenant_id TEXT,
+    project_id TEXT,
+    deleted_at TEXT,
+    deleted_by TEXT
 );
 
 CREATE TABLE IF NOT EXISTS trained_models (
@@ -78,7 +83,12 @@ CREATE TABLE IF NOT EXISTS trained_models (
     merged_path TEXT,
     artifact_dir TEXT,
     compute_node_id TEXT,
-    compute_node_name TEXT
+    compute_node_name TEXT,
+    created_by TEXT,
+    tenant_id TEXT,
+    project_id TEXT,
+    deleted_at TEXT,
+    deleted_by TEXT
 );
 
 CREATE TABLE IF NOT EXISTS model_lineage (
@@ -130,7 +140,12 @@ CREATE TABLE IF NOT EXISTS datasets (
     size TEXT,
     count INTEGER NOT NULL DEFAULT 0,
     description TEXT,
-    create_time TEXT NOT NULL
+    create_time TEXT NOT NULL,
+    created_by TEXT,
+    tenant_id TEXT,
+    project_id TEXT,
+    deleted_at TEXT,
+    deleted_by TEXT
 );
 
 CREATE TABLE IF NOT EXISTS dataset_files (
@@ -413,6 +428,18 @@ CREATE TABLE IF NOT EXISTS acls (
     permission TEXT NOT NULL,
     create_time TEXT
 );
+ALTER TABLE models ADD COLUMN IF NOT EXISTS deleted_at TEXT;
+ALTER TABLE models ADD COLUMN IF NOT EXISTS deleted_by TEXT;
+ALTER TABLE trained_models ADD COLUMN IF NOT EXISTS deleted_at TEXT;
+ALTER TABLE trained_models ADD COLUMN IF NOT EXISTS deleted_by TEXT;
+ALTER TABLE datasets ADD COLUMN IF NOT EXISTS deleted_at TEXT;
+ALTER TABLE datasets ADD COLUMN IF NOT EXISTS deleted_by TEXT;
+ALTER TABLE eval_tasks ADD COLUMN IF NOT EXISTS deleted_at TEXT;
+ALTER TABLE eval_tasks ADD COLUMN IF NOT EXISTS deleted_by TEXT;
+CREATE UNIQUE INDEX IF NOT EXISTS uq_acls_subject_permission
+    ON acls(resource_type, resource_id, principal_type, principal_id, permission);
+CREATE INDEX IF NOT EXISTS idx_acls_resource ON acls(resource_type, resource_id);
+CREATE INDEX IF NOT EXISTS idx_acls_principal ON acls(principal_type, principal_id);
 
 -- ---- 权限扩展（来源：004_permissions.sql） ----
 
@@ -475,6 +502,9 @@ CREATE TABLE IF NOT EXISTS approval_steps (
     comment TEXT,
     time TEXT
 );
+CREATE INDEX IF NOT EXISTS idx_approval_instances_applicant ON approval_instances(applicant_id, status);
+CREATE INDEX IF NOT EXISTS idx_approval_instances_resource ON approval_instances(resource_type, resource_id, status);
+CREATE INDEX IF NOT EXISTS idx_approval_steps_approver ON approval_steps(approver_id, status);
 
 CREATE TABLE IF NOT EXISTS audit_logs (
     id TEXT PRIMARY KEY,