feat: 权限与日志治理完善，MinIO 独立部署与 tiktoken 离线打包适配

- 后端：强化平台/审批/资源/系统接口权限校验与操作日志，更新权限设计文档与测试用例
- 存储：新增 MinIO 独立部署适配（端口 19000/19001），外部端点与 host-gateway 互通
- 离线：打包 tiktoken cl100k_base 词表进镜像，避免无网环境联网下载
- 其他：算力节点接口微调，前端微调创建页小修，忽略 MinIO 运行时数据

Co-Authored-By: Claude <noreply@anthropic.com>

backend/app/modules/approval/router.py

@@ -1,21 +1,23 @@
 from __future__ import annotations
 
-from fastapi import APIRouter, Body
+from fastapi import APIRouter, Body, Depends
 from typing import Any
 
 from app.api.v1.endpoints.platform import ok, fail
 from app.db.platform_store import get_platform_store
+from app.core.auth import get_current_user, is_admin
 
 router = APIRouter(prefix="/approvals", tags=["approval"])
 
 
 @router.get("/templates")
-def list_templates() -> dict[str, Any]:
+def list_templates(current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     return ok(get_platform_store().approval_templates())
 
 
 @router.post("/templates")
-def create_template(payload: dict[str, Any] = Body(...)) -> dict[str, Any]:
+def create_template(payload: dict[str, Any] = Body(...), current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
+    if not is_admin(current_user): raise fail(403, "admin permission required")
     if not payload.get("name"):
         raise fail(400, "name 必填")
     return ok(get_platform_store().create_approval_template(payload))
@@ -30,7 +32,8 @@ def get_template(template_id: str) -> dict[str, Any]:
 
 
 @router.put("/templates/{template_id}")
-def update_template(template_id: str, payload: dict[str, Any] = Body(...)) -> dict[str, Any]:
+def update_template(template_id: str, payload: dict[str, Any] = Body(...), current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
+    if not is_admin(current_user): raise fail(403, "admin permission required")
     try:
         return ok(get_platform_store().update_approval_template(template_id, payload))
     except KeyError:
@@ -38,7 +41,8 @@ def update_template(template_id: str, payload: dict[str, Any] = Body(...)) -> di
 
 
 @router.delete("/templates/{template_id}")
-def delete_template(template_id: str) -> dict[str, Any]:
+def delete_template(template_id: str, current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
+    if not is_admin(current_user): raise fail(403, "admin permission required")
     try:
         return ok(get_platform_store().delete_approval_template(template_id))
     except KeyError:
@@ -46,13 +50,15 @@ def delete_template(template_id: str) -> dict[str, Any]:
 
 
 @router.get("")
-def list_instances(status: str | None = None) -> dict[str, Any]:
-    return ok(get_platform_store().approval_instances(status=status))
+def list_instances(status: str | None = None, current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
+    items = get_platform_store().approval_instances(status=status)
+    return ok(items if is_admin(current_user) else [item for item in items if item.get("applicant_id") == current_user.get("id")])
 
 
 @router.post("")
-def create_instance(payload: dict[str, Any] = Body(...)) -> dict[str, Any]:
-    for field in ("resource_type", "resource_id", "applicant_id"):
+def create_instance(payload: dict[str, Any] = Body(...), current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
+    payload["applicant_id"] = current_user.get("id")
+    for field in ("resource_type", "resource_id"):
         if not payload.get(field):
             raise fail(400, f"{field} 必填")
     try:
@@ -62,9 +68,12 @@ def create_instance(payload: dict[str, Any] = Body(...)) -> dict[str, Any]:
 
 
 @router.get("/{instance_id}")
-def get_instance(instance_id: str) -> dict[str, Any]:
+def get_instance(instance_id: str, current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     try:
-        return ok(get_platform_store().approval_instance(instance_id))
+        item = get_platform_store().approval_instance(instance_id)
+        if not is_admin(current_user) and item.get("applicant_id") != current_user.get("id"):
+            raise fail(403, "no permission to access approval")
+        return ok(item)
     except KeyError:
         raise fail(404, "instance not found")