feat: complete phase 02 RBAC and data scope recovery

backend/src/main/resources/db/migration/V028__add_service_location_operator_scope.sql

@@ -0,0 +1,12 @@
+-- V028: Phase 02 服务站运营人员数据范围
+-- 组织关系不授予数据权限；只有显式站点分配或预约任务分配可访问。
+CREATE TABLE service_location_operators (
+    service_location_id UUID NOT NULL REFERENCES service_locations(id),
+    operator_id UUID NOT NULL REFERENCES operators(id),
+    created_by UUID REFERENCES operators(id),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (service_location_id, operator_id)
+);
+
+CREATE INDEX idx_service_location_operators_operator
+    ON service_location_operators(operator_id, service_location_id);

backend/src/main/resources/db/migration/V029__complete_service_station_permissions.sql

@@ -0,0 +1,14 @@
+-- V1.1 Phase 02: complete the service-station permission contract from the customer baseline.
+INSERT INTO permissions (id, code, name, module, description) VALUES
+('20000000-0000-0000-0000-000000000800', 'activity.checkin', '活动签到', 'activity', '执行活动扫码或人工签到并查看签到统计'),
+('20000000-0000-0000-0000-000000000801', 'service.assisted_registration', '现场协助登记', 'service', '在服务站现场协助用户完成服务登记');
+
+INSERT INTO role_permissions (role_id, permission_id)
+SELECT '00000000-0000-0000-0000-000000000010', id
+FROM permissions
+WHERE code IN ('activity.checkin', 'service.assisted_registration');
+
+INSERT INTO role_permissions (role_id, permission_id)
+SELECT '00000000-0000-0000-0000-000000000002', id
+FROM permissions
+WHERE code IN ('activity.checkin', 'service.assisted_registration');