feat: 平台治理与权限体系完善，存储进度/GPU预留/审批中心与日志整合

- 平台治理: 租户用户权限层次、资源ACL、审批中心与审批模板、访问申请
- 存储: MinIO 存储进度迁移、对象存储安全加固与测试
- 计算: GPU 资源预留、compute 轮询与同步增强
- 权限: permission v2 迁移、权限安全验收测试
- 日志: 后端运行日志中文说明、操作日志整合
- 数据处理/评测: 数据转换与模型评测优化

Co-Authored-By: Claude <noreply@anthropic.com>

backend/app/db/sql/010_permission_quota_membership.sql

@@ -0,0 +1,21 @@
+-- Permission 2.0: atomic tenant quota reservations for GPU-backed tasks.
+-- This migration is additive and safe to run repeatedly.
+
+CREATE TABLE IF NOT EXISTS tenant_quota_reservations (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    owner_type TEXT NOT NULL,
+    owner_id TEXT NOT NULL,
+    gpu_count INTEGER NOT NULL DEFAULT 0,
+    storage_bytes BIGINT NOT NULL DEFAULT 0,
+    status TEXT NOT NULL DEFAULT 'reserved',
+    create_time TEXT NOT NULL,
+    released_at TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_tenant_quota_reservations_tenant
+    ON tenant_quota_reservations(tenant_id, status);
+CREATE INDEX IF NOT EXISTS idx_tenant_quota_reservations_owner
+    ON tenant_quota_reservations(owner_type, owner_id, status);
+CREATE UNIQUE INDEX IF NOT EXISTS uq_tenant_quota_reservations_active_owner
+    ON tenant_quota_reservations(owner_type, owner_id) WHERE status = 'reserved';