feat: add global auth settings and pending users

app/(app)/app/layout.tsx

@@ -1,5 +1,6 @@
 import { redirect } from "next/navigation";
 
+import { PendingAssignment } from "@/modules/auth/components/PendingAssignment";
 import { getBootstrapState, getCurrentAuthContext } from "@/modules/core/server/auth";
 import { AppShell } from "@/modules/shared/components/AppShell";
 
@@ -20,6 +21,10 @@ export default async function AppLayout({ children }: AppLayoutProps): Promise<R
     redirect("/login");
   }
 
+  if (!context.organization && context.permissions.length === 0) {
+    return <PendingAssignment account={context.account} />;
+  }
+
   return (
     <AppShell account={context.account} permissions={context.permissions}>
       {children}

app/(app)/app/settings/global/page.tsx

@@ -0,0 +1,32 @@
+import { redirect } from "next/navigation";
+
+import { Badge } from "@/components/ui/badge";
+import { getCurrentAuthContext } from "@/modules/core/server/auth";
+import { hasPermission } from "@/modules/core/server/permissions";
+import { getSystemSettings } from "@/modules/core/server/system-settings";
+import { GlobalSettingsClient } from "@/modules/settings/components/GlobalSettingsClient";
+
+export default async function GlobalSettingsPage(): Promise<React.ReactElement> {
+  const context = await getCurrentAuthContext();
+  if (!context) {
+    redirect("/login");
+  }
+
+  if (!hasPermission(context.permissions, "platform:manage")) {
+    redirect("/app/dashboard");
+  }
+
+  const settings = await getSystemSettings();
+
+  return (
+    <div className="flex flex-col gap-5">
+      <section>
+        <Badge variant="success">Global</Badge>
+        <h2 className="mt-3 text-xl font-semibold">全局配置</h2>
+        <p className="mt-1 text-sm text-muted-foreground">平台级注册策略、OIDC 默认配置和用户头像声明映射。</p>
+      </section>
+
+      <GlobalSettingsClient settings={settings} />
+    </div>
+  );
+}

app/(app)/app/settings/users/page.tsx

@@ -10,6 +10,7 @@ import type { RoleId } from "@/modules/core/types";
 import { TableToolbar } from "@/modules/settings/components/TableToolbar";
 import { UserAccountActions, UserManagementClient } from "@/modules/settings/components/UserManagementClient";
 import { getPage, getPageCount, getSearchParam, paginate, type SearchParams } from "@/modules/settings/lib/pagination";
+import { UserAvatar } from "@/modules/shared/components/UserAvatar";
 
 type UsersPageProps = {
   searchParams?: Promise<SearchParams>;
@@ -105,8 +106,13 @@ export default async function UsersPage({ searchParams }: UsersPageProps): Promi
                 {visibleAccounts.map((account) => (
                   <tr className="table-row-enter hover:bg-secondary/45" key={account.id}>
                     <td className="px-4 py-3">
-                      <p className="font-medium">{account.name}</p>
-                      <p className="text-xs text-muted-foreground">{account.email}</p>
+                      <div className="flex items-center gap-3">
+                        <UserAvatar avatarUrl={account.avatarUrl} name={account.name} size="sm" />
+                        <div className="min-w-0">
+                          <p className="truncate font-medium">{account.name}</p>
+                          <p className="truncate text-xs text-muted-foreground">{account.email}</p>
+                        </div>
+                      </div>
                     </td>
                     <td className="px-4 py-3">{formatRoleLabel(account.role)}</td>
                     <td className="px-4 py-3 text-muted-foreground">{account.organization ?? "-"}</td>