feat(permission): replace OA roles with post-bound roles and assignee posts

Unify effective roles via post-role bindings, remove dedicated OA role UI, and update OA assignee resolution plus related SQL/docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

web-admin/src/api/admin.ts

@@ -833,6 +833,18 @@ export function fetchUpdatePostBoundUsers(postId: string, userIds: string[]) {
   })
 }
 
+export function fetchPostBoundRoleIds(postId: string) {
+  return request.get<{ roleIds: string[] }>({ url: `/web/admin/posts/${postId}/roles` })
+}
+
+export function fetchUpdatePostBoundRoles(postId: string, roleIds: string[]) {
+  return request.put({
+    url: `/web/admin/posts/${postId}/roles`,
+    params: { roleIds },
+    showSuccessMessage: true
+  })
+}
+
 // ---------------------------------------------------------------------------
 // 物品单位管理
 // ---------------------------------------------------------------------------