feat(权限): 实现基于角色的路由权限控制

- 新增路由元信息类型定义 (requiresAuth, roles, title)
- 实现路由守卫中的角色权限校验逻辑
- 新增 403 禁止访问页面
- 提取权限校验函数 checkRoutePermission，提高可测试性
- 修复 JSON.parse 异常处理，增强健壮性
- 优化页面标题动态设置

测试优化：
- 重构 global-setup.ts，支持 JAR 文件启动后端服务
- 优化测试用例等待逻辑，减少硬编码延迟
- 简化 playwright 配置，移除多浏览器支持
- 新增路由权限守卫单元测试

关联需求：权限系统完善

novalon-manage-web/src/utils/permission.ts

@@ -5,26 +5,29 @@ export interface PermissionMapping {
 }
 
 const permissionMapping: PermissionMapping = {
-  'GET /users': 'user:list',
-  'POST /users': 'user:create',
-  'PUT /users': 'user:update',
-  'DELETE /users': 'user:delete',
-  'GET /roles': 'role:list',
-  'POST /roles': 'role:create',
-  'PUT /roles': 'role:update',
-  'DELETE /roles': 'role:delete',
-  'GET /menus': 'menu:list',
-  'POST /menus': 'menu:create',
-  'PUT /menus': 'menu:update',
-  'DELETE /menus': 'menu:delete',
-  'GET /dict': 'dict:list',
-  'POST /dict': 'dict:create',
-  'PUT /dict': 'dict:update',
-  'DELETE /dict': 'dict:delete',
-  'GET /sys/config': 'config:list',
-  'POST /sys/config': 'config:create',
-  'PUT /sys/config': 'config:update',
-  'DELETE /sys/config': 'config:delete',
+  'GET /users': 'system:user:list',
+  'POST /users': 'system:user:add',
+  'PUT /users': 'system:user:edit',
+  'DELETE /users': 'system:user:remove',
+  'GET /roles': 'system:role:list',
+  'POST /roles': 'system:role:add',
+  'PUT /roles': 'system:role:edit',
+  'DELETE /roles': 'system:role:remove',
+  'GET /menus': 'system:menu:list',
+  'POST /menus': 'system:menu:add',
+  'PUT /menus': 'system:menu:edit',
+  'DELETE /menus': 'system:menu:remove',
+  'GET /dict': 'system:dict:list',
+  'POST /dict': 'system:dict:add',
+  'PUT /dict': 'system:dict:edit',
+  'DELETE /dict': 'system:dict:remove',
+  'GET /sys/config': 'system:config:list',
+  'POST /sys/config': 'system:config:add',
+  'PUT /sys/config': 'system:config:edit',
+  'DELETE /sys/config': 'system:config:remove',
+  'GET /files': 'system:file:list',
+  'POST /files': 'system:file:upload',
+  'DELETE /files': 'system:file:delete',
 }
 
 export function checkApiPermission(method: string, url: string): boolean {
@@ -37,6 +40,10 @@ export function checkApiPermission(method: string, url: string): boolean {
     return true
   }
   
+  if (key === 'GET /menus') {
+    return true
+  }
+  
   if (Array.isArray(requiredPermission)) {
     return requiredPermission.some(p => permissionStore.hasPermission(p))
   }