feat: 平台治理与对象存储增强，审批中心与运行日志整合

- 新增 storage/policy.py 落盘策略：按大小/类型决定文件存 MinIO 或内联数据库
- 数据处理源文件与生成结果写入 MinIO 并登记 storage_objects，支持失败回滚
- 算力节点训练产物按版本归档到 MinIO，登记 model_artifacts
- 数据转换任务输入输出对象化，支持从 MinIO 读写
- 新增审批中心（申请/我的/策略）、组织与权限、运行日志整合页面
- schema 与 docker 配置、前端路由侧边栏、治理文档同步更新

Co-Authored-By: Claude <noreply@anthropic.com>

frontend/src/router/index.ts

@@ -32,11 +32,17 @@ const routes: RouteRecordRaw[] = [
         meta: { title: '服务看板' },
       },
       // 平台治理
+      {
+        path: 'organization',
+        name: 'organization',
+        component: () => import('@/views/governance/OrganizationPermissionView.vue'),
+        meta: { title: '组织与权限', pageSurface: 'self', permission: 'user-settings' },
+      },
       {
         path: 'tenants',
         name: 'tenants',
-        component: () => import('@/views/tenants/TenantListView.vue'),
-        meta: { title: '租户管理', permission: 'user-settings' },
+        redirect: '/organization?tab=tenants',
+        meta: { title: '租户与配额', permission: 'user-settings' },
       },
       {
         path: 'tenants/:id',
@@ -47,37 +53,37 @@ const routes: RouteRecordRaw[] = [
       {
         path: 'projects',
         name: 'projects',
-        component: () => import('@/views/projects/ProjectListView.vue'),
-        meta: { title: '项目空间', permission: 'user-settings' },
+        redirect: '/organization?tab=users',
+        meta: { title: '组织与权限', permission: 'user-settings' },
       },
       {
         path: 'projects/:id',
         name: 'project-detail',
-        component: () => import('@/views/projects/ProjectDetailView.vue'),
-        meta: { title: '项目详情', permission: 'user-settings' },
+        redirect: '/organization?tab=users',
+        meta: { title: '组织与权限', permission: 'user-settings' },
       },
       {
         path: 'audit-logs',
         name: 'audit-logs',
-        component: () => import('@/views/audit/AuditLogView.vue'),
-        meta: { title: '审计日志', permission: 'user-settings' },
+        redirect: '/logs?tab=audit',
+        meta: { title: '运行日志', permission: 'user-settings' },
       },
       {
         path: 'operation-logs',
         name: 'operation-logs',
-        component: () => import('@/views/audit/OperationLogView.vue'),
-        meta: { title: '操作日志', permission: 'user-settings' },
+        redirect: '/logs?tab=operations',
+        meta: { title: '运行日志', permission: 'user-settings' },
       },
       {
         path: 'approval-templates',
         name: 'approval-templates',
-        component: () => import('@/views/approvals/ApprovalTemplateView.vue'),
-        meta: { title: '审批模板', permission: 'user-settings' },
+        redirect: '/approval-instances?tab=strategies',
+        meta: { title: '审批中心', permission: 'user-settings' },
       },
       {
         path: 'approval-instances',
         name: 'approval-instances',
-        component: () => import('@/views/approvals/ApprovalInstanceView.vue'),
+        component: () => import('@/views/approvals/ApprovalCenterView.vue'),
         meta: { title: '审批中心', permission: 'user-settings' },
       },
       {
@@ -302,14 +308,14 @@ const routes: RouteRecordRaw[] = [
       {
         path: 'logs',
         name: 'logs',
-        component: () => import('@/views/system/LogsView.vue'),
-        meta: { title: '查看日志' },
+        component: () => import('@/views/system/RuntimeLogsView.vue'),
+        meta: { title: '运行日志', pageSurface: 'self', permission: 'logs' },
       },
       {
         path: 'user-settings',
         name: 'user-settings',
-        component: () => import('@/views/system/UserSettingsView.vue'),
-        meta: { title: '用户设置', pageSurface: 'self', permission: 'user-settings' },
+        redirect: '/organization?tab=users',
+        meta: { title: '组织与权限', pageSurface: 'self', permission: 'user-settings' },
       },
       {
         path: 'user-settings/create',
@@ -357,6 +363,7 @@ const permissionBySegment: Record<string, PermissionCode> = {
   tools: 'data-convert',
   hardware: 'hardware',
   logs: 'logs',
+  organization: 'user-settings',
   'user-settings': 'user-settings',
   tenants: 'user-settings',
   projects: 'user-settings',
@@ -379,7 +386,7 @@ function requiredPermission(path: string, explicit?: unknown) {
 // 权限控制规则（基于 governance-user-guide.md 设计）：
 // - admin 用户：可以访问所有页面
 // - 非 admin 用户：默认可访问所有业务页面（训练、评测、推理、数据等）
-//   仅以下页面限制 admin 访问：user-settings、compute（算力节点）
+//   仅治理与资源管理页面限制 admin 访问：organization、user-settings、compute
 router.beforeEach((to, _from, next) => {
   if (!to.meta.public) routeLoading.value = true
   const auth = useAuthStore()
@@ -404,7 +411,7 @@ router.beforeEach((to, _from, next) => {
   if (!to.meta.skipPermission) {
     const permission = requiredPermission(to.path, to.meta.permission)
     // 仅限制管理员专属页面的访问权限
-    // user-settings（用户设置、租户管理、项目空间、审批、审计日志）仅 admin 可访问
+    // user-settings（组织与权限、资源授权、审批中心、运行日志）仅 admin 可访问
     if (permission === 'user-settings' && !auth.isAdmin) {
       next({ name: 'permission-denied', replace: true })
       return