feat: multi-tenant workspace isolation, RBAC, sidebar nav, billing, and Android enhancements

- Backend: workspace_id isolation for 14 model tables + safe migration/backfill
- Backend: RBAC system with 4 roles and 23 permissions, seeded on startup
- Backend: workspace admin endpoints (list/manage all workspaces)
- Backend: admin user management API (CRUD, reset password)
- Backend: billing API with subscription plans, usage tracking, rate limiting
- Backend: fix system_logs.py UNION query and wrong column references
- Backend: WebSocket JWT auth and workspace enforcement
- Frontend: sidebar navigation replacing top dropdown menu
- Frontend: user management page (Users.vue) for admins
- Frontend: enhanced Workspaces.vue with admin table view
- Frontend: workspace RBAC computed properties in user store
- Android: agent marketplace, billing/subscription UI, onboarding wizard
- Android: phone login, analytics tracker, crash handler, network diagnostics
- Android: splash screen, encrypted token storage, app update enhancements
- Docs: multi-tenant RBAC guide with 8 sections and role-permission matrix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/api/agents.py

@@ -11,6 +11,7 @@ import logging
 from app.core.database import get_db
 from app.models.agent import Agent
 from app.api.auth import get_current_user
+from app.api.deps import require_workspace_admin, WorkspaceContext
 from app.models.user import User
 from app.core.exceptions import NotFoundError, ValidationError, ConflictError
 from app.services.permission_service import check_agent_permission
@@ -385,10 +386,11 @@ async def update_agent(
 async def delete_agent(
     agent_id: str,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user)
+    current_user: User = Depends(get_current_user),
+    _ws_admin: WorkspaceContext = Depends(require_workspace_admin),
 ):
     """
-    删除Agent（只有所有者可以删除）
+    删除Agent（仅工作区管理员和平台管理员可操作）
     """
     agent = db.query(Agent).filter(Agent.id == agent_id).first()
     
@@ -435,11 +437,12 @@ async def delete_agent(
 async def deploy_agent(
     agent_id: str,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user)
+    current_user: User = Depends(get_current_user),
+    _ws_admin: WorkspaceContext = Depends(require_workspace_admin),
 ):
     """
-    部署Agent
-    
+    部署Agent（仅工作区管理员和平台管理员可操作）
+
     将Agent状态设置为published
     """
     agent = db.query(Agent).filter(Agent.id == agent_id).first()
@@ -463,11 +466,12 @@ async def deploy_agent(
 async def stop_agent(
     agent_id: str,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user)
+    current_user: User = Depends(get_current_user),
+    _ws_admin: WorkspaceContext = Depends(require_workspace_admin),
 ):
     """
-    停止Agent
-    
+    停止Agent（仅工作区管理员和平台管理员可操作）
+
     将Agent状态设置为stopped
     """
     agent = db.query(Agent).filter(Agent.id == agent_id).first()
@@ -601,8 +605,9 @@ async def create_main_agent(
     agent_id: str,
     db: Session = Depends(get_db),
     current_user: User = Depends(get_current_user),
+    _ws_admin: WorkspaceContext = Depends(require_workspace_admin),
 ):
-    """一键将当前 Agent 升级为 Main Agent（预置专用工具 + 系统提示词）"""
+    """一键将当前 Agent 升级为 Main Agent（仅工作区管理员和平台管理员可操作）"""
     agent = db.query(Agent).filter(Agent.id == agent_id).first()
     if not agent:
         raise NotFoundError(f"Agent不存在: {agent_id}")