feat(admin): gate user/order/city delete behind assignable HQ permissions

Add users_delete, orders_delete, cities_delete; default HQ (incl. super admin) has none until explicitly granted.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/admin-web/src/pages/UsersPage.tsx

@@ -18,7 +18,7 @@ import {
 } from 'antd';
 import type { ColumnsType } from 'antd/es/table';
 import { USER_SOURCE_TYPE_LABELS, type UserSourceType } from '@dukang/shared-types';
-import { request, type AdminUserRow, type Paginated } from '../lib/api';
+import { request, type AdminUserRow, type HqProfile, type Paginated } from '../lib/api';
 import { ORDER_STATUS_LABELS, fmtTime, maskPhone } from '../lib/constants';
 
 type UserOrderRow = {
@@ -66,6 +66,7 @@ export default function UsersPage() {
   const navigate = useNavigate();
   const location = useLocation();
   const [form] = Form.useForm();
+  const [profile, setProfile] = useState<HqProfile | null>(null);
   const [data, setData] = useState<Paginated<AdminUserRow> | null>(null);
   const [loading, setLoading] = useState(false);
   const [page, setPage] = useState(1);
@@ -82,6 +83,11 @@ export default function UsersPage() {
   const [batchPreviewLoading, setBatchPreviewLoading] = useState(false);
   const [batchDeleting, setBatchDeleting] = useState(false);
   const [batchRiskAck, setBatchRiskAck] = useState(false);
+  const canDeleteUsers = (profile?.permissionKeys ?? []).includes('users_delete');
+
+  useEffect(() => {
+    request<HqProfile>('/admin/auth/me').then(setProfile).catch(() => {});
+  }, []);
 
   const load = useCallback(async () => {
     setLoading(true);
@@ -309,13 +315,15 @@ export default function UsersPage() {
     <div>
       <Space style={{ marginBottom: 16, width: '100%', justifyContent: 'space-between' }}>
         <Typography.Title level={4} style={{ margin: 0 }}>用户监控</Typography.Title>
-        <Button
-          danger
-          disabled={!selectedRowKeys.length}
-          onClick={() => void openBatchDeleteModal()}
-        >
-          批量删除{selectedRowKeys.length ? ` (${selectedRowKeys.length})` : ''}
-        </Button>
+        {canDeleteUsers ? (
+          <Button
+            danger
+            disabled={!selectedRowKeys.length}
+            onClick={() => void openBatchDeleteModal()}
+          >
+            批量删除{selectedRowKeys.length ? ` (${selectedRowKeys.length})` : ''}
+          </Button>
+        ) : null}
       </Space>
       <Form form={form} layout="inline" style={{ marginBottom: 16 }} onFinish={() => { setPage(1); void load(); }}>
         <Form.Item name="phone" label="手机号">
@@ -353,11 +361,11 @@ export default function UsersPage() {
         columns={columns}
         dataSource={data?.items ?? []}
         scroll={{ x: 1500 }}
-        rowSelection={{
+        rowSelection={canDeleteUsers ? {
           selectedRowKeys,
           preserveSelectedRowKeys: true,
           onChange: (keys) => setSelectedRowKeys(keys as string[]),
-        }}
+        } : undefined}
         pagination={{
           current: page,
           pageSize,
@@ -375,9 +383,9 @@ export default function UsersPage() {
         width={640}
         open={drawerOpen}
         onClose={() => setDrawerOpen(false)}
-        extra={detail && (
+        extra={detail && canDeleteUsers ? (
           <Button danger onClick={openDeleteModal}>删除用户</Button>
-        )}
+        ) : undefined}
       >
         {detail && (
           <>