feat: multi-tenant workspace isolation, RBAC, sidebar nav, billing, and Android enhancements

- Backend: workspace_id isolation for 14 model tables + safe migration/backfill
- Backend: RBAC system with 4 roles and 23 permissions, seeded on startup
- Backend: workspace admin endpoints (list/manage all workspaces)
- Backend: admin user management API (CRUD, reset password)
- Backend: billing API with subscription plans, usage tracking, rate limiting
- Backend: fix system_logs.py UNION query and wrong column references
- Backend: WebSocket JWT auth and workspace enforcement
- Frontend: sidebar navigation replacing top dropdown menu
- Frontend: user management page (Users.vue) for admins
- Frontend: enhanced Workspaces.vue with admin table view
- Frontend: workspace RBAC computed properties in user store
- Android: agent marketplace, billing/subscription UI, onboarding wizard
- Android: phone login, analytics tracker, crash handler, network diagnostics
- Android: splash screen, encrypted token storage, app update enhancements
- Docs: multi-tenant RBAC guide with 8 sections and role-permission matrix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/api/plugins.py

@@ -11,6 +11,7 @@ import logging
 
 from app.core.database import get_db
 from app.api.auth import get_current_user
+from app.api.deps import get_current_workspace_id
 from app.models.user import User
 from app.models.plugin import NodePlugin
 from app.services.plugin_loader import (
@@ -202,11 +203,14 @@ async def create_plugin(
 async def get_plugin(
     plugin_id: str,
     db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
 ):
-    """获取插件详情。"""
+    """获取插件详情（仅所有者或公开插件可查看）。"""
     plugin = db.query(NodePlugin).filter(NodePlugin.id == plugin_id).first()
     if not plugin:
         raise HTTPException(status_code=404, detail="插件不存在")
+    if not plugin.is_public and plugin.user_id and plugin.user_id != current_user.id:
+        raise HTTPException(status_code=403, detail="无权查看此插件")
     return plugin
 
 
@@ -222,7 +226,7 @@ async def update_plugin(
     plugin = db.query(NodePlugin).filter(NodePlugin.id == plugin_id).first()
     if not plugin:
         raise HTTPException(status_code=404, detail="插件不存在")
-    if plugin.user_id and plugin.user_id != current_user.id:
+    if plugin.user_id != current_user.id:
         raise HTTPException(status_code=403, detail="无权修改此插件")
 
     for field, value in body.dict(exclude_unset=True).items():
@@ -251,7 +255,7 @@ async def delete_plugin(
     plugin = db.query(NodePlugin).filter(NodePlugin.id == plugin_id).first()
     if not plugin:
         raise HTTPException(status_code=404, detail="插件不存在")
-    if plugin.user_id and plugin.user_id != current_user.id:
+    if plugin.user_id != current_user.id:
         raise HTTPException(status_code=403, detail="无权删除此插件")
 
     unload_plugin_code(plugin.id)
@@ -271,6 +275,8 @@ async def toggle_plugin(
     plugin = db.query(NodePlugin).filter(NodePlugin.id == plugin_id).first()
     if not plugin:
         raise HTTPException(status_code=404, detail="插件不存在")
+    if plugin.user_id != current_user.id:
+        raise HTTPException(status_code=403, detail="无权操作此插件")
 
     plugin.enabled = not plugin.enabled
     if plugin.enabled:
@@ -310,11 +316,14 @@ async def test_plugin(
     plugin_id: str,
     body: PluginExecuteRequest,
     db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
 ):
-    """在沙箱中测试执行插件。"""
+    """在沙箱中测试执行插件（仅所有者可测试）。"""
     plugin = db.query(NodePlugin).filter(NodePlugin.id == plugin_id).first()
     if not plugin:
         raise HTTPException(status_code=404, detail="插件不存在")
+    if plugin.user_id != current_user.id:
+        raise HTTPException(status_code=403, detail="无权测试此插件")
     if not plugin.code:
         raise HTTPException(status_code=400, detail="插件无代码")