feat: 权限与日志治理完善，MinIO 独立部署与 tiktoken 离线打包适配

- 后端：强化平台/审批/资源/系统接口权限校验与操作日志，更新权限设计文档与测试用例
- 存储：新增 MinIO 独立部署适配（端口 19000/19001），外部端点与 host-gateway 互通
- 离线：打包 tiktoken cl100k_base 词表进镜像，避免无网环境联网下载
- 其他：算力节点接口微调，前端微调创建页小修，忽略 MinIO 运行时数据

Co-Authored-By: Claude <noreply@anthropic.com>

docker/app/docker-compose.yml

@@ -63,7 +63,9 @@ services:
       COMPUTE_POLL_BATCH_SIZE: ${COMPUTE_POLL_BATCH_SIZE:-100}
       COMPUTE_REQUEST_TIMEOUT_SECONDS: ${COMPUTE_REQUEST_TIMEOUT_SECONDS:-5}
       MINIO_ENABLED: ${MINIO_ENABLED:-false}
-      MINIO_ENDPOINT: ${MINIO_ENDPOINT:-http://minio:9000}
+      # Use the storage server's externally reachable address. Do not use a
+      # MinIO container name because storage is deployed independently.
+      MINIO_ENDPOINT: ${MINIO_ENDPOINT:-http://host.docker.internal:19000}
       MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY:-minioadmin}
       MINIO_SECRET_KEY: ${MINIO_SECRET_KEY:-minioadmin}
       MINIO_BUCKET: ${MINIO_BUCKET:-yg-ft-resources}
@@ -75,6 +77,8 @@ services:
       - ../../backend:/app:ro
       - ../../runtime/app/logs/backend:/opt/yg-ft/logs/backend
       - ../../runtime/app/data:/data/yg-ft
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     networks:
       - yg-ft-app
     healthcheck: