feat: 接入真实登录与成员权限

- auth/members/messages: 新增超级管理员登录、成员权限和密码消息流程
- agent-config/agent: 支持服务端保存 Agent 配置并取消未配置 mock 成功结果
- projects/deploy-runs/settings: 按当前用户权限保护真实接口
- prisma: 新增用户、项目权限和平台消息表结构

prisma/schema.prisma

@@ -64,6 +64,30 @@ enum OutboxStatus {
   DEAD
 }
 
+enum UserRole {
+  SUPER_ADMIN
+  MEMBER
+}
+
+enum UserStatus {
+  ACTIVE
+  DISABLED
+}
+
+enum ProjectPermissionLevel {
+  READ
+  BUILD
+}
+
+enum PlatformMessageType {
+  PASSWORD_RESET_REQUEST
+}
+
+enum PlatformMessageStatus {
+  PENDING
+  HANDLED
+}
+
 model Project {
   id            String        @id @default(cuid())
   key           String        @unique
@@ -78,6 +102,7 @@ model Project {
   environments Environment[]
   deployJobs   DeployJob[]
   deployRuns   DeployRun[]
+  permissions  ProjectMemberPermission[]
 
   @@map("projects")
 }
@@ -194,6 +219,68 @@ model AuditLog {
   @@map("audit_logs")
 }
 
+model User {
+  id                 String     @id @default(cuid())
+  account            String     @unique
+  displayName        String
+  role               UserRole   @default(MEMBER)
+  status             UserStatus @default(ACTIVE)
+  passwordHash       String     @db.Text
+  mustChangePassword Boolean    @default(false)
+  passwordVersion    Int        @default(1)
+  lastLoginAt        DateTime?
+  createdById        String?
+  createdAt          DateTime   @default(now())
+  updatedAt          DateTime   @updatedAt
+
+  projectPermissions ProjectMemberPermission[]
+  requestedMessages  PlatformMessage[]         @relation("message_requester")
+  handledMessages    PlatformMessage[]         @relation("message_handler")
+
+  @@index([role, status])
+  @@map("users")
+}
+
+model ProjectMemberPermission {
+  id        String                 @id @default(cuid())
+  userId    String
+  projectId String
+  level     ProjectPermissionLevel
+  createdAt DateTime               @default(now())
+  updatedAt DateTime               @updatedAt
+
+  user    User    @relation(fields: [userId], references: [id], onDelete: Cascade)
+  project Project @relation(fields: [projectId], references: [id], onDelete: Cascade)
+
+  @@unique([userId, projectId])
+  @@index([projectId])
+  @@map("project_member_permissions")
+}
+
+model PlatformMessage {
+  id                 String                @id @default(cuid())
+  type               PlatformMessageType
+  status             PlatformMessageStatus @default(PENDING)
+  title              String
+  content            String                @db.Text
+  requesterId        String?
+  requesterAccount   String
+  targetResourceType String?
+  targetResourceId   String?
+  metadata           Json?
+  handledById        String?
+  handledAt          DateTime?
+  createdAt          DateTime              @default(now())
+  updatedAt          DateTime              @updatedAt
+
+  requester User? @relation("message_requester", fields: [requesterId], references: [id], onDelete: SetNull)
+  handler   User? @relation("message_handler", fields: [handledById], references: [id], onDelete: SetNull)
+
+  @@index([type, status, createdAt])
+  @@index([requesterId, status])
+  @@map("platform_messages")
+}
+
 model Secret {
   id             String         @id @default(cuid())
   provider       SecretProvider