feat(permission): replace OA roles with post-bound roles and assignee posts

Unify effective roles via post-role bindings, remove dedicated OA role UI, and update OA assignee resolution plus related SQL/docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/menu.py

@@ -870,13 +870,6 @@ STATIC_MENU_TREE = [
                         "component": "/oa-approval/apps/index",
                         "meta": {"title": "审批管理", "keepAlive": True, "menuCode": "oa:apps:list"},
                     },
-                    {
-                        "id": "OA000000000000000000000000000102",
-                        "name": "OaApprovalRoles",
-                        "path": "roles",
-                        "component": "/oa-approval/roles/index",
-                        "meta": {"title": "工作流角色", "keepAlive": True, "menuCode": "oa:roles:list"},
-                    },
                     {
                         "id": "OA000000000000000000000000000103",
                         "name": "OaApprovalStart",