feat: permissions CRUD browser integration + E2E enhancements

Backend:
- permission_handler: 完善权限 CRUD 接口（列表/创建/更新/删除）
- auth_handler: 修复认证处理逻辑
- router: 新增权限管理路由
- handler_test: 新增权限 handler 测试覆盖

Frontend:
- permissions.ts/test.ts: 权限服务层完整实现
- profile/settings/service_tests: 服务适配器修正
- client.ts: HTTP 客户端健壮性增强
- vite.config.js: 构建配置优化
- E2E 脚本: run-playwright-cdp-e2e 大幅增强（权限流程覆盖）

Docs:
- REAL_PROJECT_STATUS: 状态更新
- PRODUCTION_CHECKLIST/QUALITY_STANDARD/TECHNICAL_GUIDE/PROJECT_EXPERIENCE_SUMMARY: 团队规范完善
- plans/2026-04-23: 权限浏览器 CRUD 设计方案

验证: go build 0错误

frontend/admin/scripts/run-cdp-smoke.ps1

@@ -104,18 +104,19 @@ function Get-BrowserArguments {
   $arguments = @(
     "--remote-debugging-port=$Port",
     "--user-data-dir=$ProfileDir",
-    '--no-sandbox'
+    '--no-sandbox',
+    '--disable-dev-shm-usage',
+    '--disable-background-networking',
+    '--disable-background-timer-throttling',
+    '--disable-renderer-backgrounding',
+    '--disable-sync',
+    '--disable-gpu'
   )
 
   if (Test-HeadlessShellBrowser -BrowserPath $BrowserPath) {
     $arguments += '--single-process'
   } else {
     $arguments += @(
-      '--disable-dev-shm-usage',
-      '--disable-background-networking',
-      '--disable-background-timer-throttling',
-      '--disable-renderer-backgrounding',
-      '--disable-sync',
       '--headless=new'
     )
   }

frontend/admin/scripts/run-playwright-auth-e2e.ps1

@@ -103,6 +103,28 @@ function Wait-UrlReady {
   throw "$Label did not become ready: $Url"
 }
 
+function Sync-AdminBootstrapExpectation {
+  param(
+    [Parameter(Mandatory = $true)][string]$BackendBaseUrl
+  )
+
+  $capabilitiesUrl = "$BackendBaseUrl/api/v1/auth/capabilities"
+  $response = Invoke-RestMethod -Uri $capabilitiesUrl -Method Get -TimeoutSec 15
+  $requiresBootstrap = $false
+
+  if ($response -and $response.data -and $null -ne $response.data.admin_bootstrap_required) {
+    $requiresBootstrap = [bool]$response.data.admin_bootstrap_required
+  }
+
+  if ($requiresBootstrap) {
+    $env:E2E_EXPECT_ADMIN_BOOTSTRAP = '1'
+  } else {
+    Remove-Item Env:E2E_EXPECT_ADMIN_BOOTSTRAP -ErrorAction SilentlyContinue
+  }
+
+  Write-Host "playwright e2e admin bootstrap expected: $requiresBootstrap"
+}
+
 function Start-ManagedProcess {
   param(
     [Parameter(Mandatory = $true)][string]$Name,
@@ -280,7 +302,6 @@ try {
   $env:E2E_LOGIN_PASSWORD = $AdminPassword
   $env:E2E_LOGIN_EMAIL = $AdminEmail
   $env:E2E_BOOTSTRAP_SECRET = $bootstrapSecret
-  $env:E2E_EXPECT_ADMIN_BOOTSTRAP = '1'
   $env:E2E_EXTERNAL_WEB_SERVER = '1'
   $env:E2E_BASE_URL = $frontendBaseUrl
   $env:E2E_API_BASE_URL = "$backendBaseUrl/api/v1"
@@ -289,7 +310,7 @@ try {
   Push-Location $frontendRoot
   try {
     $lastError = $null
-    $suiteAttempts = 2
+    $suiteAttempts = 3
     if ($env:E2E_SUITE_ATTEMPTS) {
       $parsedSuiteAttempts = 0
       if ([int]::TryParse($env:E2E_SUITE_ATTEMPTS, [ref]$parsedSuiteAttempts) -and $parsedSuiteAttempts -gt 0) {
@@ -299,6 +320,7 @@ try {
 
     for ($attempt = 1; $attempt -le $suiteAttempts; $attempt++) {
       try {
+        Sync-AdminBootstrapExpectation -BackendBaseUrl $backendBaseUrl
         & (Join-Path $PSScriptRoot 'run-cdp-smoke.ps1') `
           -Port $BrowserPort `
           -Command @('node', './scripts/run-playwright-cdp-e2e.mjs')