后台支持多账号与页面访问权限

保留环境变量管理员作为 owner，并新增可持久化管理的 member 账号
建立一级页面权限、实时会话失效和后端逐请求鉴权
统一操作记录与配置记录展示管理员显示名称，隐藏内部主体标识
补充账号管理页面、生成绑定、定向测试和技术文档

apps/admin-web/src/api/adminApiClient.test.ts

@@ -1,16 +1,61 @@
 import { afterEach, expect, test, vi } from 'vitest';
 
 import {
+  createAdminAccount,
   executeAdminRechargeRefund,
   getAdminUserDetail,
   listAdminRechargeOrders,
   resolveAdminRechargeRefundManualReview,
+  updateAdminAccount,
 } from './adminApiClient';
 
 afterEach(() => {
   vi.unstubAllGlobals();
 });
 
+test('后台账号创建和更新携带 owner 会话与 Tab 权限', async () => {
+  const fetchMock = vi.fn().mockImplementation(() =>
+    Promise.resolve(
+      new Response(JSON.stringify({account: {accountId: 'member-1'}}), {
+        status: 200,
+      }),
+    ),
+  );
+  vi.stubGlobal('fetch', fetchMock);
+
+  await createAdminAccount('owner-token', {
+    username: 'operator',
+    displayName: '运营',
+    password: 'secret123',
+    tabPermissions: ['dashboard', 'tracking'],
+    enabled: true,
+  });
+  await updateAdminAccount('owner-token', 'member/1', {
+    displayName: '运营二组',
+    tabPermissions: ['tracking'],
+    enabled: false,
+  });
+
+  expect(fetchMock.mock.calls[0]?.[0]).toBe('/admin/api/accounts');
+  expect(fetchMock.mock.calls[0]?.[1]).toEqual(
+    expect.objectContaining({
+      method: 'POST',
+      headers: expect.objectContaining({Authorization: 'Bearer owner-token'}),
+    }),
+  );
+  expect(fetchMock.mock.calls[1]?.[0]).toBe('/admin/api/accounts/member%2F1');
+  expect(fetchMock.mock.calls[1]?.[1]).toEqual(
+    expect.objectContaining({
+      method: 'PUT',
+      body: JSON.stringify({
+        displayName: '运营二组',
+        tabPermissions: ['tracking'],
+        enabled: false,
+      }),
+    }),
+  );
+});
+
 test('充值订单查询按后台契约序列化筛选参数', async () => {
   const fetchMock = vi.fn().mockResolvedValue(
     new Response(JSON.stringify({ entries: [] }), {