feat: virtual company module, team projects, PWA dishes app, and startup scripts overhaul

- Add company module (3-tier org, CEO planning, parallel departments)
- Add company orchestrator, knowledge extractor, presets, scheduler
- Add company API endpoints, models, and frontend views
- Add 今天吃啥 PWA app (69 dishes, real images, offline support)
- Add team_projects output directory structure
- Add unified manage.ps1 for service lifecycle
- Add Windows startup guide v1.0
- Add TTS troubleshooting doc
- Update frontend (AgentChat UX overhaul, new views)
- Update backend (voice engine fix, multi-tenant, RBAC)
- Remove deprecated startup scripts and old docs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/api/system_logs.py

@@ -14,6 +14,7 @@ from pydantic import BaseModel
 from app.core.database import get_db
 from app.core.config import settings
 from app.api.auth import get_current_user
+from app.api.deps import require_admin
 from app.models.user import User
 from app.models.execution_log import ExecutionLog
 from app.models.agent_execution_log import AgentExecutionLog
@@ -172,18 +173,12 @@ def _build_union_query(
     return queries
 
 
-def _check_admin(current_user: User):
-    if getattr(current_user, "role", None) != "admin":
-        from app.core.exceptions import ForbiddenError
-        raise ForbiddenError("仅管理员可访问系统日志")
-
-
 # ── Endpoints ────────────────────────────────────────────────────
 
 @router.get("", response_model=List[UnifiedLogItem])
 async def get_system_logs(
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    _admin: User = Depends(require_admin()),
     source: Optional[str] = Query(None, description="日志来源: execution/agent/llm/all"),
     level: Optional[str] = Query(None, description="日志级别: INFO/WARN/ERROR"),
     keyword: Optional[str] = Query(None, description="关键词搜索"),
@@ -192,21 +187,10 @@ async def get_system_logs(
     skip: int = Query(0, ge=0),
     limit: int = Query(50, ge=1, le=1000),
 ):
-    """
-    统一日志查询：跨 execution_logs / agent_execution_logs / agent_llm_logs 联合查询。
-    管理员可查全部，普通用户只能查看自己相关的 Agent 执行日志和 LLM 日志。
-    """
-    _check_admin(current_user)
-
-    # 解析时间
+    """统一日志查询（仅管理员）。"""
     sd = datetime.fromisoformat(start_date) if start_date else None
     ed = datetime.fromisoformat(end_date) if end_date else None
 
-    # 非 admin 限制用户范围
-    user_id = None
-    if getattr(current_user, "role", None) != "admin":
-        user_id = current_user.id
-
     results: list[UnifiedLogItem] = []
 
     # 1) 工作流执行日志
@@ -241,8 +225,6 @@ async def get_system_logs(
             q = q.filter(AgentExecutionLog.created_at >= sd)
         if ed:
             q = q.filter(AgentExecutionLog.created_at <= ed)
-        if user_id:
-            q = q.filter(AgentExecutionLog.user_id == user_id)
         if level:
             if level.upper() == "ERROR":
                 q = q.filter(AgentExecutionLog.success == False)
@@ -297,11 +279,9 @@ async def get_system_logs(
 @router.get("/stats", response_model=LogStatsResponse)
 async def get_system_logs_stats(
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    _admin: User = Depends(require_admin()),
 ):
     """获取系统日志统计：各级别计数、各来源计数、24小时趋势"""
-    _check_admin(current_user)
-
     now = datetime.utcnow()
     today_start = now.replace(hour=0, minute=0, second=0, microsecond=0)
     hours_24 = now - timedelta(hours=24)
@@ -382,13 +362,11 @@ async def get_system_logs_stats(
 
 @router.get("/app-logs", response_model=List[AppLogItem])
 async def get_app_logs(
-    current_user: User = Depends(get_current_user),
+    _admin: User = Depends(require_admin()),
     lines: int = Query(200, ge=10, le=2000, description="读取行数"),
     level: Optional[str] = Query(None, description="按级别过滤: INFO/WARNING/ERROR"),
 ):
     """读取应用程序文件日志的尾部行"""
-    _check_admin(current_user)
-
     log_file = Path(settings.LOG_DIR) / "app.log"
     if not log_file.exists():
         return []