feat(permission): replace OA roles with post-bound roles and assignee posts

Unify effective roles via post-role bindings, remove dedicated OA role UI, and update OA assignee resolution plus related SQL/docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/admin.py

@@ -1046,6 +1046,46 @@ async def update_post_bound_users(
         return error_response(400, str(e))
 
 
+class PostRolesUpdateBody(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+
+    role_ids: List[str] = Field(default_factory=list, alias="roleIds")
+
+
+@router.get("/posts/{post_id}/roles")
+async def list_post_bound_roles(
+    post_id: str,
+    user: dict = Depends(require_menu_code("system:post:list")),
+    db: Session = Depends(get_db),
+):
+    tenant_no = _get_tenant_no(db, user)
+    post = post_svc.get_post(db, post_id)
+    if not post or post.tenant_no != tenant_no:
+        return error_response(404, "职位不存在")
+    ids = post_svc.list_role_ids_for_post(db, post_id, tenant_no)
+    return success_response({"roleIds": ids})
+
+
+@router.put("/posts/{post_id}/roles")
+async def update_post_bound_roles(
+    post_id: str,
+    body: PostRolesUpdateBody,
+    user: dict = Depends(require_admin_or_super_admin),
+    db: Session = Depends(get_db),
+):
+    tenant_no = _get_tenant_no(db, user)
+    post = post_svc.get_post(db, post_id)
+    if not post or post.tenant_no != tenant_no:
+        return error_response(404, "职位不存在")
+    try:
+        post_svc.sync_post_role_bindings(
+            db, post_id, tenant_no, body.role_ids, user.get("user_id")
+        )
+        return success_response(None, message="保存成功")
+    except ValueError as e:
+        return error_response(400, str(e))
+
+
 # ---------------------------------------------------------------------------
 # 物品单位管理
 # ---------------------------------------------------------------------------