feat: multi-tenant workspace isolation, RBAC, sidebar nav, billing, and Android enhancements

- Backend: workspace_id isolation for 14 model tables + safe migration/backfill
- Backend: RBAC system with 4 roles and 23 permissions, seeded on startup
- Backend: workspace admin endpoints (list/manage all workspaces)
- Backend: admin user management API (CRUD, reset password)
- Backend: billing API with subscription plans, usage tracking, rate limiting
- Backend: fix system_logs.py UNION query and wrong column references
- Backend: WebSocket JWT auth and workspace enforcement
- Frontend: sidebar navigation replacing top dropdown menu
- Frontend: user management page (Users.vue) for admins
- Frontend: enhanced Workspaces.vue with admin table view
- Frontend: workspace RBAC computed properties in user store
- Android: agent marketplace, billing/subscription UI, onboarding wizard
- Android: phone login, analytics tracker, crash handler, network diagnostics
- Android: splash screen, encrypted token storage, app update enhancements
- Docs: multi-tenant RBAC guide with 8 sections and role-permission matrix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/api/tools.py

@@ -13,6 +13,7 @@ from pydantic import BaseModel
 from sqlalchemy.orm import Session
 
 from app.api.auth import get_current_user
+from app.api.deps import require_workspace_admin, WorkspaceContext
 from app.core.database import get_db
 from app.models.tool import Tool
 from app.models.user import User
@@ -355,8 +356,12 @@ async def delete_tool(
 
 
 @router.post("/reload")
-async def reload_tools(db: Session = Depends(get_db)):
-    """从数据库重新加载所有自定义工具到注册表（热更新）。"""
+async def reload_tools(
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+    _ws_admin: WorkspaceContext = Depends(require_workspace_admin),
+):
+    """从数据库重新加载所有自定义工具到注册表（热更新，仅工作区管理员可操作）。"""
     # 清除旧的自定义工具
     for name in list(tool_registry._custom_tool_configs.keys()):
         if name not in tool_registry._builtin_tools: