feat: ship OA drafts/badges, role dual-track, and test-env deploy tooling.

Add approval instance drafts with menu badges, dual-track user/role read model and role bound names, form-designer outline docs, and bare-metal test deploy scripts. Ignore local test-server credential file.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitignore

@@ -94,3 +94,6 @@ exports/
 # Graphify：增量检测/状态文件（commit hook 或 update-graph.sh 触发后产生）
 **/.graphify_detect.json
 **/.graphify_incremental.json
+
+# 本地密钥（勿提交）
+测试环境机器的账号密码