fix(web): 按权限隐藏管理工作台入口

基于 /api/v1/me 返回的当前用户角色控制主导航，仅向具备 power 或 manager 权限的 operator、manager、admin 展示管理工作台。所有已登录页面统一加载当前用户身份，避免停留首页时无法正确判断权限。\n\n新增角色映射与导航渲染回归测试。已验证前端 152 项测试、前端构建、pnpm lint 和 git diff --cached --check。

apps/web/src/App.tsx

@@ -117,6 +117,7 @@ import {
 } from './api';
 import type { ConsoleData, StatItem } from './app-state';
 import { AppShell } from './components/layout/AppShell';
+import { canAccessAdminWorkspace } from './auth-permissions';
 import { LoginRequiredPanel } from './components/LoginRequiredPanel';
 import { OIDCCallbackNotice } from './components/OIDCCallbackNotice';
 import { useCatalogOperations } from './hooks/useCatalogOperations';
@@ -483,7 +484,8 @@ export function App() {
       loadedDataKeysRef.current.delete('walletTransactions');
       loadingDataKeysRef.current.delete('walletTransactions');
     }
-    await ensureData(dataKeysForRoute(activePage, adminSection, workspaceSection, Boolean(nextToken)), nextToken, force);
+    const routeKeys = dataKeysForRoute(activePage, adminSection, workspaceSection, Boolean(nextToken));
+    await ensureData(nextToken ? ['currentUser', ...routeKeys] : routeKeys, nextToken, force);
   }
 
   async function ensureData(keys: DataKey[], nextToken = token, force = false) {
@@ -1410,6 +1412,7 @@ export function App() {
   return (
     <AppShell
       activePage={activePage}
+      canAccessAdmin={canAccessAdminWorkspace(currentUser)}
       health={health}
       isAuthenticated={isAuthenticated}
       state={state}