feat: 第一阶段基础框架搭建

后端 (Laravel 10 + Sanctum):
- RBAC 四层权限系统 (users→roles→permissions→menus)
- 门店隔离中间件 (BelongsToStore Trait + StoreIsolation Middleware)
- 操作日志中间件 (自动记录写操作)
- 权限检查中间件 (CheckPermission)
- 16张数据库表迁移 (系统基础+RBAC+字典+配置)
- 11个 Eloquent Model
- Auth API (登录/登出/用户信息)
- 系统设置模块 CRUD (门店/部门/职务/用户/角色/菜单/权限/字典/日志)
- 45条 RESTful API 路由
- InitSeeder 初始数据 (超管/角色/76权限/31菜单)

前端 (Vue 3 + Element Plus + Vite):
- Axios 请求封装 + Token 注入
- Pinia 状态管理 (user + permission store)
- 动态路由 (服务端菜单→前端路由自动生成)
- 后台布局 (侧边栏+顶栏+主内容区)
- 登录页 + 仪表盘首页
- 系统设置 7 个 CRUD 页面

技术方案文档 (7卷):
- 技术总览/数据库设计/API规范/RBAC设计/模块详设/小程序设计/部署方案

backend/app/Http/Controllers/Admin/AuthController.php

@@ -0,0 +1,88 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+
+class AuthController extends Controller
+{
+    /**
+     * 登录
+     */
+    public function login(Request $request): JsonResponse
+    {
+        $request->validate([
+            'username' => 'required|string',
+            'password' => 'required|string',
+        ]);
+
+        $user = User::withoutGlobalScope('store')
+            ->where('username', $request->username)
+            ->first();
+
+        if (!$user || !Hash::check($request->password, $user->password)) {
+            return $this->error('用户名或密码错误', 40100, 401);
+        }
+
+        if ($user->status->value !== 1) {
+            return $this->error('账号已被禁用或待审核', 40101, 403);
+        }
+
+        // 清除旧 token
+        $user->tokens()->delete();
+
+        $token = $user->createToken('admin')->plainTextToken;
+
+        $user->update(['last_login_at' => now()]);
+
+        return $this->success([
+            'token' => $token,
+            'user' => [
+                'id' => $user->id,
+                'username' => $user->username,
+                'name' => $user->name,
+                'avatar' => $user->avatar,
+                'store_id' => $user->store_id,
+                'is_super' => $user->is_super,
+            ],
+        ]);
+    }
+
+    /**
+     * 退出登录
+     */
+    public function logout(Request $request): JsonResponse
+    {
+        $request->user()->currentAccessToken()->delete();
+        return $this->success(null, '退出成功');
+    }
+
+    /**
+     * 获取当前用户信息
+     */
+    public function me(Request $request): JsonResponse
+    {
+        $user = $request->user();
+        $user->load(['department', 'position', 'roles']);
+
+        return $this->success([
+            'id' => $user->id,
+            'username' => $user->username,
+            'name' => $user->name,
+            'phone' => $user->phone,
+            'email' => $user->email,
+            'avatar' => $user->avatar,
+            'store_id' => $user->store_id,
+            'is_super' => $user->is_super,
+            'department' => $user->department?->name,
+            'position' => $user->position?->name,
+            'roles' => $user->roles->pluck('name'),
+            'permissions' => $user->getAllPermissionCodes(),
+            'menus' => $user->getMenuTree(),
+        ]);
+    }
+}