feat: multi-tenant workspace isolation, RBAC, sidebar nav, billing, and Android enhancements

- Backend: workspace_id isolation for 14 model tables + safe migration/backfill
- Backend: RBAC system with 4 roles and 23 permissions, seeded on startup
- Backend: workspace admin endpoints (list/manage all workspaces)
- Backend: admin user management API (CRUD, reset password)
- Backend: billing API with subscription plans, usage tracking, rate limiting
- Backend: fix system_logs.py UNION query and wrong column references
- Backend: WebSocket JWT auth and workspace enforcement
- Frontend: sidebar navigation replacing top dropdown menu
- Frontend: user management page (Users.vue) for admins
- Frontend: enhanced Workspaces.vue with admin table view
- Frontend: workspace RBAC computed properties in user store
- Android: agent marketplace, billing/subscription UI, onboarding wizard
- Android: phone login, analytics tracker, crash handler, network diagnostics
- Android: splash screen, encrypted token storage, app update enhancements
- Docs: multi-tenant RBAC guide with 8 sections and role-permission matrix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/api/data_sources.py

@@ -10,6 +10,7 @@ import logging
 from app.core.database import get_db
 from app.models.data_source import DataSource
 from app.api.auth import get_current_user
+from app.api.deps import require_workspace_admin, WorkspaceContext
 from app.models.user import User
 from app.core.exceptions import NotFoundError, ValidationError
 from app.services.data_source_connector import DataSourceConnector
@@ -163,9 +164,10 @@ async def update_data_source(
 async def delete_data_source(
     data_source_id: str,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user)
+    current_user: User = Depends(get_current_user),
+    _ws_admin: WorkspaceContext = Depends(require_workspace_admin),
 ):
-    """删除数据源"""
+    """删除数据源（仅工作区管理员和平台管理员可操作）"""
     data_source = db.query(DataSource).filter(
         DataSource.id == data_source_id,
         DataSource.user_id == current_user.id