feat(M02-C): 建立RBAC与门店数据范围

backend/src/auth/auth-repository.ts

@@ -119,6 +119,29 @@ export class AuthRepository {
         );
       }
       if (!user || user.status !== 'ACTIVE') throw new Error('USER_DISABLED');
+      await connection.execute(
+        `INSERT IGNORE INTO qipai_roles (tenant_id, code, name) VALUES
+          (?, 'CUSTOMER', '顾客'),
+          (?, 'CLEANER', '保洁员'),
+          (?, 'STAFF', '门店员工'),
+          (?, 'STORE_ADMIN', '门店管理员'),
+          (?, 'TENANT_ADMIN', '租户管理员'),
+          (?, 'PLATFORM_ADMIN', '平台管理员')`,
+        Array(6).fill(input.context.tenantId)
+      );
+      await connection.execute(
+        `INSERT IGNORE INTO qipai_user_roles (tenant_id, user_id, role_id)
+         SELECT ?, ?, id FROM qipai_roles
+         WHERE tenant_id = ? AND code = 'CUSTOMER' AND status = 'ACTIVE'`,
+        [input.context.tenantId, user.id, input.context.tenantId]
+      );
+      await connection.execute(
+        `INSERT IGNORE INTO qipai_role_permissions (tenant_id, role_id, permission_id)
+         SELECT ?, r.id, p.id FROM qipai_roles r
+         INNER JOIN qipai_permissions p ON p.code IN ('profile.read', 'order.self.read')
+         WHERE r.tenant_id = ? AND r.code = 'CUSTOMER'`,
+        [input.context.tenantId, input.context.tenantId]
+      );
       await connection.execute(
         `INSERT INTO qipai_auth_sessions
           (id, tenant_id, platform_app_id, user_id, role_version, expires_at, ip, user_agent)