feat: 平台治理与权限体系完善，存储进度/GPU预留/审批中心与日志整合

- 平台治理: 租户用户权限层次、资源ACL、审批中心与审批模板、访问申请
- 存储: MinIO 存储进度迁移、对象存储安全加固与测试
- 计算: GPU 资源预留、compute 轮询与同步增强
- 权限: permission v2 迁移、权限安全验收测试
- 日志: 后端运行日志中文说明、操作日志整合
- 数据处理/评测: 数据转换与模型评测优化

Co-Authored-By: Claude <noreply@anthropic.com>

frontend/src/router/index.ts

@@ -50,18 +50,6 @@ const routes: RouteRecordRaw[] = [
         component: () => import('@/views/tenants/TenantDetailView.vue'),
         meta: { title: '租户详情', permission: 'user-settings' },
       },
-      {
-        path: 'projects',
-        name: 'projects',
-        redirect: '/organization?tab=users',
-        meta: { title: '组织与权限', permission: 'user-settings' },
-      },
-      {
-        path: 'projects/:id',
-        name: 'project-detail',
-        redirect: '/organization?tab=users',
-        meta: { title: '组织与权限', permission: 'user-settings' },
-      },
       {
         path: 'audit-logs',
         name: 'audit-logs',
@@ -72,7 +60,7 @@ const routes: RouteRecordRaw[] = [
         path: 'operation-logs',
         name: 'operation-logs',
         redirect: '/logs?tab=operations',
-        meta: { title: '运行日志', permission: 'user-settings' },
+        meta: { title: '运行日志', permission: 'logs' },
       },
       {
         path: 'approval-templates',
@@ -84,7 +72,17 @@ const routes: RouteRecordRaw[] = [
         path: 'approval-instances',
         name: 'approval-instances',
         component: () => import('@/views/approvals/ApprovalCenterView.vue'),
-        meta: { title: '审批中心', permission: 'user-settings' },
+        meta: { title: '审批中心', permission: 'user-settings', selfService: true },
+      },
+      {
+        path: 'tenant-invitations',
+        redirect: '/approval-instances?tab=invitations',
+        meta: { title: '审批中心', selfService: true },
+      },
+      {
+        path: 'resource-access-requests',
+        redirect: '/approval-instances?tab=access',
+        meta: { title: '审批中心', selfService: true },
       },
       {
         path: 'resource-acl',
@@ -366,7 +364,6 @@ const permissionBySegment: Record<string, PermissionCode> = {
   organization: 'user-settings',
   'user-settings': 'user-settings',
   tenants: 'user-settings',
-  projects: 'user-settings',
   'audit-logs': 'user-settings',
   'operation-logs': 'user-settings',
   'approval-templates': 'user-settings',
@@ -411,17 +408,22 @@ router.beforeEach((to, _from, next) => {
   if (!to.meta.skipPermission) {
     const permission = requiredPermission(to.path, to.meta.permission)
     // 仅限制管理员专属页面的访问权限
-    // user-settings（组织与权限、资源授权、审批中心、运行日志）仅 admin 可访问
-    if (permission === 'user-settings' && !auth.isAdmin) {
+    // user-settings（组织与权限、资源授权、审批中心）仅 admin 可访问
+    const selfService = to.meta.selfService === true && (!to.query.tab || ['mine', 'access', 'invitations', 'compute'].includes(String(to.query.tab)))
+    if (permission === 'user-settings' && !auth.isAdmin && !selfService) {
       next({ name: 'permission-denied', replace: true })
       return
     }
     // compute（算力节点/GPU 分配）仅 admin 可访问
-    if (permission === 'compute' && !auth.isAdmin) {
+   if (permission === 'compute' && !auth.isAdmin) {
+     next({ name: 'permission-denied', replace: true })
+     return
+   }
+    if (permission === 'logs' && !auth.isAdmin && !auth.hasPermission('logs')) {
       next({ name: 'permission-denied', replace: true })
       return
     }
-    // 其他所有业务页面对已登录用户开放，不再检查权限码
+   // 其他所有业务页面对已登录用户开放，不再检查权限码
   }
 
   // 路由切换时记录业务模块访问（用于看板用户操作分布统计）