docs: audit reports + feature docs + skills + admin-v2 + config sync

Update audit tracker, roadmap, architecture docs,
add admin-v2 Roles page + Billing tests,
sync CLAUDE.md, Cargo.toml, docker-compose.yml,
add deep-research / frontend-design / chart-visualization skills

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

admin-v2/src/services/roles.ts

@@ -0,0 +1,50 @@
+// ============================================================
+// 角色与权限模板 服务层
+// ============================================================
+
+import request, { withSignal } from './request'
+import type {
+  Role,
+  PermissionTemplate,
+  CreateRoleRequest,
+  UpdateRoleRequest,
+  CreateTemplateRequest,
+} from '@/types'
+
+export const roleService = {
+  // ── Roles ─────────────────────────────────────────────────
+  list: (signal?: AbortSignal) =>
+    request.get<Role[]>('/roles', withSignal({}, signal)).then((r) => r.data),
+
+  get: (id: string, signal?: AbortSignal) =>
+    request.get<Role>(`/roles/${id}`, withSignal({}, signal)).then((r) => r.data),
+
+  create: (data: CreateRoleRequest, signal?: AbortSignal) =>
+    request.post<Role>('/roles', data, withSignal({}, signal)).then((r) => r.data),
+
+  update: (id: string, data: UpdateRoleRequest, signal?: AbortSignal) =>
+    request.put<Role>(`/roles/${id}`, data, withSignal({}, signal)).then((r) => r.data),
+
+  delete: (id: string, signal?: AbortSignal) =>
+    request.delete(`/roles/${id}`, withSignal({}, signal)).then((r) => r.data),
+
+  // ── Role Permissions ──────────────────────────────────────
+  getPermissions: (roleId: string, signal?: AbortSignal) =>
+    request.get<string[]>(`/roles/${roleId}/permissions`, withSignal({}, signal)).then((r) => r.data),
+
+  // ── Permission Templates ──────────────────────────────────
+  listTemplates: (signal?: AbortSignal) =>
+    request.get<PermissionTemplate[]>('/permission-templates', withSignal({}, signal)).then((r) => r.data),
+
+  getTemplate: (id: string, signal?: AbortSignal) =>
+    request.get<PermissionTemplate>(`/permission-templates/${id}`, withSignal({}, signal)).then((r) => r.data),
+
+  createTemplate: (data: CreateTemplateRequest, signal?: AbortSignal) =>
+    request.post<PermissionTemplate>('/permission-templates', data, withSignal({}, signal)).then((r) => r.data),
+
+  deleteTemplate: (id: string, signal?: AbortSignal) =>
+    request.delete(`/permission-templates/${id}`, withSignal({}, signal)).then((r) => r.data),
+
+  applyTemplate: (templateId: string, accountIds: string[], signal?: AbortSignal) =>
+    request.post(`/permission-templates/${templateId}/apply`, { account_ids: accountIds }, withSignal({}, signal)).then((r) => r.data),
+}