feat: multi-tenant workspace isolation, RBAC, sidebar nav, billing, and Android enhancements

- Backend: workspace_id isolation for 14 model tables + safe migration/backfill
- Backend: RBAC system with 4 roles and 23 permissions, seeded on startup
- Backend: workspace admin endpoints (list/manage all workspaces)
- Backend: admin user management API (CRUD, reset password)
- Backend: billing API with subscription plans, usage tracking, rate limiting
- Backend: fix system_logs.py UNION query and wrong column references
- Backend: WebSocket JWT auth and workspace enforcement
- Frontend: sidebar navigation replacing top dropdown menu
- Frontend: user management page (Users.vue) for admins
- Frontend: enhanced Workspaces.vue with admin table view
- Frontend: workspace RBAC computed properties in user store
- Android: agent marketplace, billing/subscription UI, onboarding wizard
- Android: phone login, analytics tracker, crash handler, network diagnostics
- Android: splash screen, encrypted token storage, app update enhancements
- Docs: multi-tenant RBAC guide with 8 sections and role-permission matrix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/api/websocket.py

@@ -1,14 +1,19 @@
 """
-WebSocket API
+WebSocket API — 实时推送执行状态（workspace 隔离）
 """
-from fastapi import APIRouter, WebSocket, WebSocketDisconnect
+from fastapi import APIRouter, WebSocket, WebSocketDisconnect, Query
 from app.websocket.manager import websocket_manager
 from app.core.database import SessionLocal
+from app.core.security import decode_access_token
 from app.models.execution import Execution
+from app.models.user import User
+from app.models.workspace import WorkspaceMembership
 from typing import Optional
 import json
 import asyncio
+import logging
 
+logger = logging.getLogger(__name__)
 
 router = APIRouter()
 
@@ -27,21 +32,83 @@ def _get_progress_from_redis(execution_id: str) -> Optional[dict]:
     return None
 
 
+def _validate_ws_token(token: Optional[str], execution_id: str) -> dict:
+    """验证 WebSocket JWT token，返回 {user_id, workspace_id}。
+
+    失败时返回包含 error/code 的字典，调用方应据此拒绝连接。
+    """
+    if not token:
+        return {"error": "缺少认证令牌", "code": 4001}
+
+    payload = decode_access_token(token)
+    if payload is None:
+        return {"error": "无效的访问令牌", "code": 4001}
+
+    user_id = payload.get("sub")
+    ws_id = payload.get("ws", "")
+    if not user_id:
+        return {"error": "无效的令牌载荷", "code": 4001}
+
+    # 验证用户存在且未被删除
+    db = SessionLocal()
+    try:
+        user = db.query(User).filter(User.id == user_id).first()
+        if not user:
+            return {"error": "用户不存在", "code": 4001}
+        if user.status == "deleted":
+            return {"error": "账号已注销", "code": 4003}
+
+        # 平台管理员绕过 workspace 检查
+        if user.role == "admin":
+            return {"user_id": user_id, "workspace_id": ws_id, "is_admin": True}
+
+        # 验证 workspace 成员资格
+        if ws_id:
+            membership = (
+                db.query(WorkspaceMembership)
+                .filter(
+                    WorkspaceMembership.workspace_id == ws_id,
+                    WorkspaceMembership.user_id == user_id,
+                )
+                .first()
+            )
+            if not membership:
+                return {"error": "无权访问此工作区", "code": 4003}
+
+        # 验证 execution 属于该 workspace
+        execution = db.query(Execution).filter(Execution.id == execution_id).first()
+        if execution and ws_id and execution.workspace_id and execution.workspace_id != ws_id:
+            return {"error": "无权查看此执行记录", "code": 4003}
+
+        return {"user_id": user_id, "workspace_id": ws_id}
+    finally:
+        db.close()
+
+
 @router.websocket("/api/v1/ws/executions/{execution_id}")
 async def websocket_execution_status(
     websocket: WebSocket,
     execution_id: str,
-    token: Optional[str] = None
+    token: Optional[str] = Query(None),
 ):
     """
-    WebSocket实时推送执行状态
+    WebSocket 实时推送执行状态（workspace 隔离）。
 
-    Args:
-        websocket: WebSocket连接
-        execution_id: 执行记录ID
-        token: JWT Token（可选，通过query参数传递）
+    需要 JWT token 通过 query 参数传递: ?token=xxx
+    连接建立前验证：JWT 有效性 → workspace 成员资格 → execution workspace 归属。
     """
-    await websocket_manager.connect(websocket, execution_id)
+    # ── 认证 + 鉴权 ──
+    auth = _validate_ws_token(token, execution_id)
+    if "error" in auth:
+        await websocket.accept()
+        await websocket.send_json({"type": "error", "message": auth["error"], "code": auth["code"]})
+        await websocket.close(code=auth["code"])
+        return
+
+    user_id = auth["user_id"]
+    ws_id = auth.get("workspace_id", "")
+
+    await websocket_manager.connect(websocket, execution_id, workspace_id=ws_id)
 
     db = SessionLocal()
 
@@ -139,7 +206,7 @@ async def websocket_execution_status(
     except WebSocketDisconnect:
         pass
     except Exception as e:
-        print(f"WebSocket错误: {e}")
+        logger.error("WebSocket 错误: %s", e)
         try:
             await websocket_manager.send_personal_message({
                 "type": "error",