feat: 权限与日志治理完善，MinIO 独立部署与 tiktoken 离线打包适配

- 后端：强化平台/审批/资源/系统接口权限校验与操作日志，更新权限设计文档与测试用例
- 存储：新增 MinIO 独立部署适配（端口 19000/19001），外部端点与 host-gateway 互通
- 离线：打包 tiktoken cl100k_base 词表进镜像，避免无网环境联网下载
- 其他：算力节点接口微调，前端微调创建页小修，忽略 MinIO 运行时数据

Co-Authored-By: Claude <noreply@anthropic.com>

backend/app/modules/resource/router.py

@@ -1,10 +1,11 @@
 from __future__ import annotations
 
-from fastapi import APIRouter, Body, Request
+from fastapi import APIRouter, Body, Request, Depends
 from typing import Any
 
 from app.api.v1.endpoints.platform import ok, fail
 from app.db.platform_store import get_platform_store
+from app.core.auth import get_current_user, has_resource_access, is_admin
 
 router = APIRouter(prefix="/resources", tags=["resource"])
 
@@ -16,8 +17,10 @@ def _actor(request: Request) -> str | None:
 
 
 @router.get("/{resource_type}/{resource_id}/acl")
-def get_acl(resource_type: str, resource_id: str) -> dict[str, Any]:
+def get_acl(resource_type: str, resource_id: str, current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     """查询资源 ACL，返回按主体分组的权限列表。"""
+    if not has_resource_access(resource_type, resource_id, current_user, "read"):
+        raise fail(403, "no permission to access resource ACL")
     return ok(get_platform_store().resource_acl(resource_type, resource_id))
 
 
@@ -27,9 +30,18 @@ def set_acl(
     resource_id: str,
     payload: dict[str, Any] = Body(...),
     request: Request = None,
+    current_user: dict = Depends(get_current_user),
 ) -> dict[str, Any]:
     """设置资源 ACL，body: { entries: [{ subject_type, subject_id, permissions: [] }] }"""
+    if not is_admin(current_user) and not has_resource_access(resource_type, resource_id, current_user, "write"):
+        raise fail(403, "only resource owner or admin can update ACL")
     entries = payload.get("entries") or []
+    allowed = {"read", "write", "execute", "download", "delete", "admin"}
+    for entry in entries:
+        if entry.get("principal_type") not in {"user", "role"} or not entry.get("principal_id"):
+            raise fail(400, "invalid ACL principal")
+        if any(permission not in allowed for permission in entry.get("permissions") or []):
+            raise fail(400, "invalid ACL permission")
     result = get_platform_store().set_resource_acl(resource_type, resource_id, entries)
     get_platform_store().record_audit(
         action="resource.acl.set",