feat: 权限与日志治理完善，MinIO 独立部署与 tiktoken 离线打包适配

- 后端：强化平台/审批/资源/系统接口权限校验与操作日志，更新权限设计文档与测试用例
- 存储：新增 MinIO 独立部署适配（端口 19000/19001），外部端点与 host-gateway 互通
- 离线：打包 tiktoken cl100k_base 词表进镜像，避免无网环境联网下载
- 其他：算力节点接口微调，前端微调创建页小修，忽略 MinIO 运行时数据

Co-Authored-By: Claude <noreply@anthropic.com>

backend/app/modules/system/router.py

@@ -1,9 +1,10 @@
 from __future__ import annotations
 
-from fastapi import APIRouter, Body, Query, Request
+from fastapi import APIRouter, Body, Query, Request, Depends
 from fastapi.responses import StreamingResponse
 
 from app.db.platform_store import ALL_PERMISSIONS, get_platform_store
+from app.core.auth import get_current_user, is_admin
 
 
 router = APIRouter(prefix="/system", tags=["system"])
@@ -32,13 +33,13 @@ def record_visit(payload: dict = Body(...), request: Request = None) -> dict:
 
 
 @router.get("/permissions/codes")
-def permission_codes() -> dict:
+def permission_codes(current_user: dict = Depends(get_current_user)) -> dict:
     """返回平台权限码清单（权限码接口）。"""
     return {"code": 0, "message": "ok", "data": {"codes": ALL_PERMISSIONS}}
 
 
 @router.get("/permissions")
-def permissions_overview() -> dict:
+def permissions_overview(current_user: dict = Depends(get_current_user)) -> dict:
     """返回权限码清单与角色定义。"""
     store = get_platform_store()
     return {
@@ -59,8 +60,12 @@ def audit_logs(
     end_time: str | None = Query(default=None, description="ISO8601 结束时间"),
     limit: int = Query(default=50, ge=1, le=200),
     offset: int = Query(default=0, ge=0),
+    current_user: dict = Depends(get_current_user),
 ) -> dict:
     """审计日志查询：按租户/项目/操作人/动作/目标类型/时间范围分页过滤。"""
+    if not is_admin(current_user):
+        from app.api.v1.endpoints.platform import fail
+        raise fail(403, "admin permission required")
     store = get_platform_store()
     result = store.audit_logs(
         tenant_id=tenant_id,
@@ -85,8 +90,12 @@ def audit_logs_export(
     target_type: str | None = Query(default=None, description="目标类型"),
     start_time: str | None = Query(default=None, description="ISO8601 起始时间"),
     end_time: str | None = Query(default=None, description="ISO8601 结束时间"),
+    current_user: dict = Depends(get_current_user),
 ) -> StreamingResponse:
     """审计日志导出：返回 CSV 流，与应用查询相同的过滤条件。"""
+    if not is_admin(current_user):
+        from app.api.v1.endpoints.platform import fail
+        raise fail(403, "admin permission required")
     store = get_platform_store()
     result = store.audit_logs(
         tenant_id=tenant_id,