fix(后台权限): 补上 membership-plans Tab 授权

- ADMIN_TAB_PERMISSIONS 增加 membership-plans 并把数组长度改为 22，使非 owner 管理员可被授予会员档位页权限，修复该页接口对普通管理员恒 403。
- every_assignable_admin_tab_has_a_backend_route 增加断言：路由使用的每个 Tab 必须登记在 ADMIN_TAB_PERMISSIONS。

server-rs/crates/api-server/src/admin.rs

@@ -5091,8 +5091,9 @@ mod tests {
     };
     use serde_json::{Value, json};
     use shared_contracts::admin::{
-        AdminConfirmEditorShowcaseCampaignImageUploadRequest, AdminDashboardQuery,
-        AdminDatabaseTableRowsQuery, AdminExternalApiKeyListQuery, AdminTrackingEventListQuery,
+        ADMIN_TAB_PERMISSIONS, AdminConfirmEditorShowcaseCampaignImageUploadRequest,
+        AdminDashboardQuery, AdminDatabaseTableRowsQuery, AdminExternalApiKeyListQuery,
+        AdminTrackingEventListQuery,
     };
     use shared_contracts::assets::{ConfirmAssetObjectAccessPolicy, GetReadUrlQuery};
     use spacetime_client::{
@@ -7474,6 +7475,10 @@ mod tests {
         ];
 
         for (permission, method, path) in cases {
+            assert!(
+                ADMIN_TAB_PERMISSIONS.contains(&permission),
+                "{permission} 未登记在 ADMIN_TAB_PERMISSIONS，非 owner 管理员无法被授予该 Tab"
+            );
             assert!(
                 enforce_admin_request_permission(
                     "member",

server-rs/crates/shared-contracts/src/admin.rs

@@ -10,7 +10,7 @@ use crate::creation_entry_config::{
 };
 
 /// 后台 member 可被授予的一级 Tab 权限；账号管理仅 owner 可见，不进入该集合。
-pub const ADMIN_TAB_PERMISSIONS: [&str; 21] = [
+pub const ADMIN_TAB_PERMISSIONS: [&str; 22] = [
     "dashboard",
     "overview",
     "tables",
@@ -23,6 +23,7 @@ pub const ADMIN_TAB_PERMISSIONS: [&str; 21] = [
     "profile-wallet",
     "tasks",
     "recharge-products",
+    "membership-plans",
     "recharge-orders",
     "editor-generation-pricing",
     "editor-showcase",