feat: ship OA drafts/badges, role dual-track, and test-env deploy tooling.

Add approval instance drafts with menu badges, dual-track user/role read model and role bound names, form-designer outline docs, and bare-metal test deploy scripts. Ignore local test-server credential file.

Co-authored-by: Cursor <cursoragent@cursor.com>

web-admin/src/components/oa-approval/flow-tree/FlowDesigner.vue

@@ -662,7 +662,7 @@
     cfg.postIds = [...(ac.postIds || [])]
     cfg.signMode = ac.signMode || 'or'
     memberPickBuffer.value = ''
-    rolePickBuffer.value = ''
+    postPickBuffer.value = ''
     if (showUsersPicker.value) await loadUsers()
     if (showPostsPicker.value) await loadPosts()
     drawerVisible.value = true