feat: multi-tenant workspace isolation, RBAC, sidebar nav, billing, and Android enhancements

- Backend: workspace_id isolation for 14 model tables + safe migration/backfill
- Backend: RBAC system with 4 roles and 23 permissions, seeded on startup
- Backend: workspace admin endpoints (list/manage all workspaces)
- Backend: admin user management API (CRUD, reset password)
- Backend: billing API with subscription plans, usage tracking, rate limiting
- Backend: fix system_logs.py UNION query and wrong column references
- Backend: WebSocket JWT auth and workspace enforcement
- Frontend: sidebar navigation replacing top dropdown menu
- Frontend: user management page (Users.vue) for admins
- Frontend: enhanced Workspaces.vue with admin table view
- Frontend: workspace RBAC computed properties in user store
- Android: agent marketplace, billing/subscription UI, onboarding wizard
- Android: phone login, analytics tracker, crash handler, network diagnostics
- Android: splash screen, encrypted token storage, app update enhancements
- Docs: multi-tenant RBAC guide with 8 sections and role-permission matrix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/api/workflows.py

@@ -11,6 +11,7 @@ from app.core.database import get_db
 from app.models.workflow import Workflow
 from app.models.workflow_version import WorkflowVersion
 from app.api.auth import get_current_user, UserResponse
+from app.api.deps import require_workspace_admin, WorkspaceContext
 from app.models.user import User
 from app.core.exceptions import NotFoundError, ValidationError, ConflictError
 from app.services.workflow_validator import validate_workflow
@@ -340,9 +341,10 @@ async def update_workflow(
 async def delete_workflow(
     workflow_id: str,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user)
+    current_user: User = Depends(get_current_user),
+    _ws_admin: WorkspaceContext = Depends(require_workspace_admin),
 ):
-    """删除工作流（只有所有者可以删除）"""
+    """删除工作流（仅工作区管理员和平台管理员可操作）"""
     workflow = db.query(Workflow).filter(Workflow.id == workflow_id).first()
     
     if not workflow:
@@ -610,9 +612,10 @@ async def rollback_workflow_version(
     version: int,
     rollback_data: Optional[WorkflowVersionRollback] = None,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user)
+    current_user: User = Depends(get_current_user),
+    _ws_admin: WorkspaceContext = Depends(require_workspace_admin),
 ):
-    """回滚工作流到指定版本"""
+    """回滚工作流到指定版本（仅工作区管理员和平台管理员可操作）"""
     # 验证工作流是否存在且属于当前用户
     workflow = db.query(Workflow).filter(
         Workflow.id == workflow_id,