feat(permission): replace OA roles with post-bound roles and assignee posts

Unify effective roles via post-role bindings, remove dedicated OA role UI, and update OA assignee resolution plus related SQL/docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

web-admin/src/router/modules/sqxp.ts

@@ -1374,17 +1374,6 @@ export const sqxpAdminRoutes: AppRouteRecord[] = [
               menuCode: 'oa:apps:list'
             }
           },
-          {
-            id: 'OA000000000000000000000000000102',
-            name: 'OaApprovalRoles',
-            path: 'roles',
-            component: '/oa-approval/roles/index',
-            meta: {
-              title: '工作流角色',
-              keepAlive: true,
-              menuCode: 'oa:roles:list'
-            }
-          },
           {
             id: 'OA000000000000000000000000000108',
             name: 'OaApprovalReceiveAccounts',