feat: virtual company module, team projects, PWA dishes app, and startup scripts overhaul

- Add company module (3-tier org, CEO planning, parallel departments)
- Add company orchestrator, knowledge extractor, presets, scheduler
- Add company API endpoints, models, and frontend views
- Add 今天吃啥 PWA app (69 dishes, real images, offline support)
- Add team_projects output directory structure
- Add unified manage.ps1 for service lifecycle
- Add Windows startup guide v1.0
- Add TTS troubleshooting doc
- Update frontend (AgentChat UX overhaul, new views)
- Update backend (voice engine fix, multi-tenant, RBAC)
- Remove deprecated startup scripts and old docs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/api/permissions.py

@@ -14,6 +14,7 @@ from app.models.user import User
 from app.models.workflow import Workflow
 from app.models.agent import Agent
 from app.api.auth import get_current_user
+from app.api.deps import require_admin
 from app.core.exceptions import NotFoundError, ConflictError, ValidationError
 
 logger = logging.getLogger(__name__)
@@ -60,9 +61,9 @@ async def get_roles(
     current_user: User = Depends(get_current_user)
 ):
     """获取角色列表（仅管理员）"""
-    if current_user.role != "admin":
+    if not current_user.has_permission("permission:manage"):
         raise HTTPException(status_code=403, detail="仅管理员可访问")
-    
+
     roles = db.query(Role).offset(skip).limit(limit).all()
     
     result = []
@@ -88,7 +89,7 @@ async def create_role(
     current_user: User = Depends(get_current_user)
 ):
     """创建角色（仅管理员）"""
-    if current_user.role != "admin":
+    if not current_user.has_permission("permission:manage"):
         raise HTTPException(status_code=403, detail="仅管理员可创建角色")
     
     # 检查角色名称是否已存在
@@ -131,7 +132,7 @@ async def update_role(
     current_user: User = Depends(get_current_user)
 ):
     """更新角色（仅管理员）"""
-    if current_user.role != "admin":
+    if not current_user.has_permission("permission:manage"):
         raise HTTPException(status_code=403, detail="仅管理员可更新角色")
     
     role = db.query(Role).filter(Role.id == role_id).first()
@@ -179,7 +180,7 @@ async def delete_role(
     current_user: User = Depends(get_current_user)
 ):
     """删除角色（仅管理员）"""
-    if current_user.role != "admin":
+    if not current_user.has_permission("permission:manage"):
         raise HTTPException(status_code=403, detail="仅管理员可删除角色")
     
     role = db.query(Role).filter(Role.id == role_id).first()
@@ -258,7 +259,7 @@ async def assign_user_roles(
     current_user: User = Depends(get_current_user)
 ):
     """为用户分配角色（仅管理员）"""
-    if current_user.role != "admin":
+    if not current_user.has_permission("permission:manage"):
         raise HTTPException(status_code=403, detail="仅管理员可分配角色")
     
     user = db.query(User).filter(User.id == user_id).first()
@@ -286,7 +287,7 @@ async def get_users(
     current_user: User = Depends(get_current_user)
 ):
     """获取用户列表（仅管理员）"""
-    if current_user.role != "admin":
+    if not current_user.has_permission("permission:manage"):
         raise HTTPException(status_code=403, detail="仅管理员可访问")
     
     users = db.query(User).offset(skip).limit(limit).all()
@@ -316,7 +317,7 @@ async def get_user_roles(
 ):
     """获取用户的角色列表"""
     # 用户只能查看自己的角色，管理员可以查看所有用户的角色
-    if current_user.id != user_id and current_user.role != "admin":
+    if current_user.id != user_id and not current_user.has_permission("permission:manage"):
         raise HTTPException(status_code=403, detail="无权访问")
     
     user = db.query(User).filter(User.id == user_id).first()
@@ -354,7 +355,7 @@ async def grant_workflow_permission(
         raise NotFoundError("工作流", workflow_id)
     
     # 只有工作流所有者或管理员可以授权
-    if workflow.user_id != current_user.id and current_user.role != "admin":
+    if workflow.user_id != current_user.id and not current_user.has_permission("workflow:share"):
         raise HTTPException(status_code=403, detail="无权授权此工作流")
     
     # 验证权限类型
@@ -410,7 +411,7 @@ async def get_workflow_permissions(
         raise NotFoundError("工作流", workflow_id)
     
     # 只有工作流所有者或管理员可以查看权限
-    if workflow.user_id != current_user.id and current_user.role != "admin":
+    if workflow.user_id != current_user.id and not current_user.has_permission("workflow:share"):
         raise HTTPException(status_code=403, detail="无权查看此工作流的权限")
     
     permissions = db.query(WorkflowPermission).filter(
@@ -451,8 +452,8 @@ async def revoke_workflow_permission(
         raise NotFoundError("权限", permission_id)
     
     # 只有工作流所有者、管理员或授权人可以撤销
-    if (workflow.user_id != current_user.id and 
-        current_user.role != "admin" and 
+    if (workflow.user_id != current_user.id and
+        not current_user.has_permission("workflow:share") and
         permission.granted_by != current_user.id):
         raise HTTPException(status_code=403, detail="无权撤销此权限")
     
@@ -483,7 +484,7 @@ async def grant_agent_permission(
         raise NotFoundError("Agent", agent_id)
     
     # 只有Agent所有者或管理员可以授权
-    if agent.user_id != current_user.id and current_user.role != "admin":
+    if agent.user_id != current_user.id and not current_user.has_permission("agent:deploy"):
         raise HTTPException(status_code=403, detail="无权授权此Agent")
     
     # 验证权限类型
@@ -539,7 +540,7 @@ async def get_agent_permissions(
         raise NotFoundError("Agent", agent_id)
     
     # 只有Agent所有者或管理员可以查看权限
-    if agent.user_id != current_user.id and current_user.role != "admin":
+    if agent.user_id != current_user.id and not current_user.has_permission("agent:deploy"):
         raise HTTPException(status_code=403, detail="无权查看此Agent的权限")
     
     permissions = db.query(AgentPermission).filter(
@@ -580,8 +581,8 @@ async def revoke_agent_permission(
         raise NotFoundError("权限", permission_id)
     
     # 只有Agent所有者、管理员或授权人可以撤销
-    if (agent.user_id != current_user.id and 
-        current_user.role != "admin" and 
+    if (agent.user_id != current_user.id and
+        not current_user.has_permission("agent:deploy") and
         permission.granted_by != current_user.id):
         raise HTTPException(status_code=403, detail="无权撤销此权限")