feat: better admin permissions (#5755)

* feat: add casbin admin permissions

* feat: improve audit logging to associate logs with actual operators and target users

* feat: enhance admin permissions and UI interactions for sensitive actions

* Refactor authz RBAC and tighten channel permissions

* Split channel authz field policy

* Address channel authz review findings

controller/audit.go

@@ -91,10 +91,17 @@ func recordManageAudit(c *gin.Context, action string, params map[string]interfac
 	recordManageAuditFor(c, c.GetInt("id"), action, params)
 }
 
-// recordManageAuditFor 记录一条归属于 logUserId 的管理审计日志（面向用户的操作：
-// 对目标用户的额度调整 / 解绑 / 2FA 等，使该用户也能在自己的日志中看到）。
-func recordManageAuditFor(c *gin.Context, logUserId int, action string, params map[string]interface{}) {
-	model.RecordOperationAuditLog(logUserId, auditContentEN(action, params), c.ClientIP(), action, params, auditOperatorInfo(c), nil)
+// recordManageAuditFor 记录一条管理审计日志，日志归属于操作者；targetUserId
+// 只表示被操作用户，用于在结构化参数中保留目标上下文。
+func recordManageAuditFor(c *gin.Context, targetUserId int, action string, params map[string]interface{}) {
+	if params == nil {
+		params = map[string]interface{}{}
+	}
+	operatorUserId := c.GetInt("id")
+	if _, ok := params["target_user_id"]; !ok && targetUserId > 0 && targetUserId != operatorUserId {
+		params["target_user_id"] = targetUserId
+	}
+	model.RecordOperationAuditLog(operatorUserId, auditContentEN(action, params), c.ClientIP(), action, params, auditOperatorInfo(c), nil)
 	markAuditLogged(c)
 }