feat: better admin permissions (#5755)

* feat: add casbin admin permissions

* feat: improve audit logging to associate logs with actual operators and target users

* feat: enhance admin permissions and UI interactions for sensitive actions

* Refactor authz RBAC and tighten channel permissions

* Split channel authz field policy

* Address channel authz review findings

router/authz-router.go

@@ -0,0 +1,19 @@
+package router
+
+import (
+	"github.com/QuantumNous/new-api/controller"
+	"github.com/QuantumNous/new-api/middleware"
+
+	"github.com/gin-gonic/gin"
+)
+
+// registerAuthzRoutes mounts the authorization API under its own /authz
+// namespace. GET /authz/catalog returns the permission schema (resources,
+// actions, and role baselines) used by the client permission editor.
+func registerAuthzRoutes(apiRouter *gin.RouterGroup) {
+	authzRoute := apiRouter.Group("/authz")
+	authzRoute.Use(middleware.AdminAuth())
+	{
+		authzRoute.GET("/catalog", controller.GetPermissionCatalog)
+	}
+}