feat(permission): replace OA roles with post-bound roles and assignee posts

Unify effective roles via post-role bindings, remove dedicated OA role UI, and update OA assignee resolution plus related SQL/docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

web-admin/src/utils/oa-form-create-confirmation-kit.ts

@@ -1,5 +1,6 @@
 import FcDesigner from '@form-create/designer'
 import OaConfirmationKit from '@/components/oa-approval/OaConfirmationKit.vue'
+import { ensureOaKitMenu } from '@/utils/oa-form-create-kit-menu'
 import { confirmationKitDragRule } from '@/utils/oa-confirmation-kit-rule'
 
 const FLAG = '__oaConfirmationKitConfigured'
@@ -9,14 +10,7 @@ export function setupOaConfirmationKit(formCreate?: {
 }) {
   if ((FcDesigner as any)[FLAG]) return
 
-  // kit 菜单可能已由请假套件注册；幂等再调一次无妨
-  if (typeof FcDesigner.addMenu === 'function') {
-    try {
-      FcDesigner.addMenu({ name: 'kit', title: '套件', list: [] })
-    } catch {
-      /* already */
-    }
-  }
+  ensureOaKitMenu()
 
   FcDesigner.component('confirmationKit', OaConfirmationKit)
   if (typeof formCreate?.component === 'function') {