feat: add full-stack API persistence and RBAC

app/api/settings/accounts/route.ts

@@ -0,0 +1,20 @@
+import { jsonSuccess } from "@/modules/core/server/api";
+import { requirePermission, toPublicAccount } from "@/modules/core/server/auth";
+import { readData } from "@/modules/core/server/store";
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("account:read", {
+    action: "account.list",
+    targetType: "account",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const data = await readData();
+  return jsonSuccess("账号列表已加载", {
+    accounts: data.accounts.map((account) => toPublicAccount(account)),
+  });
+}
+

app/api/settings/roles/route.ts

@@ -0,0 +1,17 @@
+import { jsonSuccess } from "@/modules/core/server/api";
+import { requirePermission } from "@/modules/core/server/auth";
+import { ROLE_DEFINITIONS } from "@/modules/core/server/permissions";
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("account:read", {
+    action: "role.list",
+    targetType: "role",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  return jsonSuccess("角色列表已加载", { roles: ROLE_DEFINITIONS });
+}
+