feat: 权限与日志治理完善，MinIO 独立部署与 tiktoken 离线打包适配

- 后端：强化平台/审批/资源/系统接口权限校验与操作日志，更新权限设计文档与测试用例
- 存储：新增 MinIO 独立部署适配（端口 19000/19001），外部端点与 host-gateway 互通
- 离线：打包 tiktoken cl100k_base 词表进镜像，避免无网环境联网下载
- 其他：算力节点接口微调，前端微调创建页小修，忽略 MinIO 运行时数据

Co-Authored-By: Claude <noreply@anthropic.com>

docker/app/.env

@@ -50,10 +50,14 @@ COMPUTE_POLL_BATCH_SIZE=100
 COMPUTE_REQUEST_TIMEOUT_SECONDS=5
 
 # MinIO object storage. Enable after the MinIO service is reachable.
-MINIO_ENABLED=false
-MINIO_ENDPOINT=http://minio:9000
+MINIO_API_PORT=19000
+MINIO_CONSOLE_PORT=19001
+MINIO_ENABLED=true
+# For split-server deployment, replace host.docker.internal with the MinIO
+# server address, for example http://10.10.20.30:19000.
+MINIO_ENDPOINT=http://172.25.179.69:19000
 MINIO_ACCESS_KEY=minioadmin
-MINIO_SECRET_KEY=minioadmin
+MINIO_SECRET_KEY=change_me_minio_secret
 MINIO_BUCKET=yg-ft-resources
 MINIO_SECURE=false
 STORAGE_WAIT_SECONDS=300