feat(identity): 支持用户和用户组批量管理

增加原子批量启用、禁用和删除接口及管理端多选操作，目标缺失时整批回滚。\n\n拆分管理端与 API Key 权限缓存并在弹窗保存后刷新候选；补齐失效规则一键清理样式、固定右侧操作列和 OpenAPI 契约。

apps/api/internal/httpapi/identity_admin_handlers.go

@@ -2,12 +2,83 @@ package httpapi
 
 import (
 	"encoding/json"
+	"errors"
 	"net/http"
 	"strings"
 
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/store"
 )
 
+// batchGatewayUsers godoc
+// @Summary 批量操作用户
+// @Description 管理端原子批量启用、禁用或软删除最多 500 个用户；任一目标不存在时整批不变更。
+// @Tags identity
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param input body store.IdentityBatchInput true "用户批量操作"
+// @Success 200 {object} IdentityBatchResponse
+// @Failure 400 {object} ErrorEnvelope
+// @Failure 401 {object} ErrorEnvelope
+// @Failure 403 {object} ErrorEnvelope
+// @Failure 404 {object} ErrorEnvelope
+// @Failure 500 {object} ErrorEnvelope
+// @Router /api/admin/users/batch [post]
+func (s *Server) batchGatewayUsers(w http.ResponseWriter, r *http.Request) {
+	var input store.IdentityBatchInput
+	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid json body")
+		return
+	}
+	result, err := s.store.BatchGatewayUsers(r.Context(), input)
+	if err != nil {
+		writeIdentityBatchError(w, s, err, "users")
+		return
+	}
+	writeJSON(w, http.StatusOK, result)
+}
+
+// batchUserGroups godoc
+// @Summary 批量操作用户组
+// @Description 管理端原子批量启用、禁用或删除最多 500 个用户组；删除时同步删除其访问规则，关联默认用户组外键按数据库约束置空。
+// @Tags identity
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param input body store.IdentityBatchInput true "用户组批量操作"
+// @Success 200 {object} IdentityBatchResponse
+// @Failure 400 {object} ErrorEnvelope
+// @Failure 401 {object} ErrorEnvelope
+// @Failure 403 {object} ErrorEnvelope
+// @Failure 404 {object} ErrorEnvelope
+// @Failure 500 {object} ErrorEnvelope
+// @Router /api/admin/user-groups/batch [post]
+func (s *Server) batchUserGroups(w http.ResponseWriter, r *http.Request) {
+	var input store.IdentityBatchInput
+	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid json body")
+		return
+	}
+	result, err := s.store.BatchUserGroups(r.Context(), input)
+	if err != nil {
+		writeIdentityBatchError(w, s, err, "user groups")
+		return
+	}
+	writeJSON(w, http.StatusOK, result)
+}
+
+func writeIdentityBatchError(w http.ResponseWriter, s *Server, err error, target string) {
+	switch {
+	case errors.Is(err, store.ErrInvalidIdentityBatch):
+		writeError(w, http.StatusBadRequest, "action must be enable, disable or delete and ids must contain 1 to 500 UUIDs")
+	case errors.Is(err, store.ErrIdentityBatchTargetNotFound):
+		writeError(w, http.StatusNotFound, "one or more "+target+" were not found")
+	default:
+		s.logger.Error("batch identity operation failed", "target", target, "error", err)
+		writeError(w, http.StatusInternalServerError, "batch "+target+" operation failed")
+	}
+}
+
 // createTenant godoc
 // @Summary 创建租户
 // @Description 管理端创建网关租户，tenantKey 和 name 必填。