feat: better admin permissions (#5755)

* feat: add casbin admin permissions

* feat: improve audit logging to associate logs with actual operators and target users

* feat: enhance admin permissions and UI interactions for sensitive actions

* Refactor authz RBAC and tighten channel permissions

* Split channel authz field policy

* Address channel authz review findings

web/default/src/i18n/locales/zh.json

@@ -223,8 +223,10 @@
     "Admin": "管理员",
     "Admin access required": "需要管理员权限",
     "Admin area": "管理员区域",
+    "Admin Channel Permissions": "管理员渠道权限",
     "Admin notes (only visible to admins)": "管理员备注（仅管理员可见）",
     "Admin Only": "仅限管理员",
+    "Admin Permissions": "管理员权限",
     "Administer user accounts and roles.": "管理用户账户和角色。",
     "Administrator account": "管理员账户",
     "Administrator username": "管理员用户名",
@@ -716,6 +718,7 @@
     "Channel ID is required": "缺少渠道 ID",
     "Channel key": "渠道密钥",
     "Channel key unlocked": "渠道密钥已解锁",
+    "Channel Management": "渠道管理",
     "Channel models": "渠道模型",
     "Channel name is required": "渠道名称是必填的",
     "Channel test completed": "渠道测试完成",
@@ -1075,6 +1078,7 @@
     "Create cache": "创建缓存",
     "Create cache ratio": "创建缓存倍率",
     "Create Channel": "创建渠道",
+    "Create channels or edit keys, base URLs, and overrides.": "创建渠道或编辑密钥、基础 URL 和覆盖规则。",
     "Create Code": "创建代码",
     "Create credentials for the root user": "为管理员创建登录凭据",
     "Create deployment": "创建部署",
@@ -1193,6 +1197,7 @@
     "Default": "默认",
     "Default (New Frontend)": "新版前端（默认）",
     "Default / range": "默认值 / 范围",
+    "Default administrator permissions can be overridden for this user.": "可以为此用户覆盖默认管理员权限。",
     "Default API Version *": "默认 API 版本 *",
     "Default API version for this channel": "此渠道的默认 API 版本",
     "Default Bearer": "默认 Bearer",
@@ -1380,8 +1385,8 @@
     "Drawing": "绘图",
     "Drawing logs": "绘制日志",
     "Drawing Logs": "绘图日志",
-    "Drawing task records": "绘图任务记录",
     "Drawing task polling": "绘图任务轮询",
+    "Drawing task records": "绘图任务记录",
     "Duplicate": "重复",
     "Duplicate group names: {{names}}": "存在重复的分组名称：{{names}}",
     "Duplicate source model mappings are not allowed": "不允许重复的源模型映射",
@@ -1448,6 +1453,7 @@
     "Edit API Shortcut": "编辑 API 快捷方式",
     "Edit billing ratios and user-selectable groups in one table.": "在一个表格中编辑计费倍率和用户可选分组。",
     "Edit Channel": "编辑渠道",
+    "Edit channel routing": "编辑渠道路由",
     "Edit chat preset": "编辑聊天预设",
     "Edit discount tier": "编辑折扣档位",
     "Edit FAQ": "编辑常见问题",
@@ -1458,6 +1464,7 @@
     "Edit model": "编辑模型",
     "Edit Model": "编辑模型",
     "Edit model pricing": "编辑模型定价",
+    "Edit non-sensitive settings such as models, groups, and routing rules.": "编辑模型、分组和路由规则等非敏感设置。",
     "Edit OAuth Provider": "编辑 OAuth 提供商",
     "Edit payment method": "编辑支付方式",
     "Edit Prefill Group": "编辑预填充组",
@@ -1465,6 +1472,7 @@
     "Edit ratio override": "编辑倍率覆盖",
     "Edit Rule": "编辑规则",
     "Edit selectable group": "编辑可选分组",
+    "Edit sensitive channel settings": "编辑敏感渠道设置",
     "Edit Tag": "编辑标签",
     "Edit Tag:": "编辑标签：",
     "Edit Uptime Kuma Group": "编辑 Uptime Kuma 分组",
@@ -2799,6 +2807,7 @@
     "No payment methods configured. Click \"Add method\" or use templates to get started.": "未配置支付方式。点击\"添加方式\"或使用模板开始。",
     "No payment methods match your search": "没有匹配的支付方式",
     "No performance data available": "暂无性能数据",
+    "No permission to perform this action": "无权进行此操作",
     "No plans available": "暂无可购买套餐",
     "No preference": "无偏好",
     "No prefill groups yet": "暂无预填充分组",
@@ -2974,6 +2983,7 @@
     "OpenAIMax": "OpenAIMax",
     "OpenRouter": "OpenRouter",
     "opens in an external client. Trigger it from the sidebar or API key actions to launch the configured application.": "在外部客户端中打开。从侧边栏或 API 密钥操作中触发，以启动配置的应用。",
+    "Operate channels": "运维渠道",
     "Operation": "操作",
     "operation and charging behavior": "运营和收费行为产生的法律责任",
     "Operation Audit Info": "操作审计信息",
@@ -3432,6 +3442,7 @@
     "Raw Quota": "原生额度",
     "Re-enable on success": "成功后重新启用",
     "Re-login": "重新登录",
+    "Read channels": "读取渠道",
     "Ready": "就绪",
     "Ready to initialize": "准备初始化",
     "Ready to simplify": "准备好简化",
@@ -3603,6 +3614,7 @@
     "Reroll": "重绘",
     "Research, analysis, scientific reasoning": "研究、分析与科学推理",
     "Resend ({{seconds}}s)": "重新发送 ({{seconds}}s)",
+    "Reserved for viewing complete channel keys after secure verification.": "预留用于在安全验证后查看完整渠道密钥。",
     "Reset": "重置",
     "Reset 2FA": "重置 2FA",
     "Reset 2FA for {{username}}? The user must set up 2FA again to continue using it.": "要重置 {{username}} 的 2FA 吗？该用户必须重新设置 2FA 后才能继续使用。",
@@ -3739,7 +3751,6 @@
     "Save Preferences": "保存偏好设置",
     "Save preview": "保存预览",
     "Save rate limits": "保存速率限制",
-    "Save token limits": "保存令牌限制",
     "Save sensitive words": "保存敏感词",
     "Save Settings": "保存设置",
     "Save sidebar modules": "保存侧边栏模块",
@@ -3748,6 +3759,7 @@
     "Save Stripe settings": "保存 Stripe 设置",
     "Save these backup codes in a safe place. Each code can only be used once.": "将这些备份代码保存在安全的地方。每个代码只能使用一次。",
     "Save these codes in a safe place. Each code can only be used once.": "将这些代码保存在安全的地方。每个代码只能使用一次。",
+    "Save token limits": "保存令牌限制",
     "Save tool prices": "保存工具价格",
     "Save Waffo Pancake settings": "保存 Waffo Pancake 设置",
     "Save Worker settings": "保存 Worker 设置",
@@ -3891,6 +3903,7 @@
     "Send email alerts when a user falls below this quota": "当用户低于此配额时发送电子邮件警报",
     "Send reset email": "发送重置邮件",
     "Sending...": "发送中...",
+    "Sensitive channel settings are read-only for your account.": "你的账号只能查看敏感渠道设置。",
     "Sensitive Words": "敏感词",
     "Sent the API key to FluentRead.": "API 密钥已发送至 FluentRead。",
     "Separate image/audio prices are enabled.": "已启用图像/音频单独定价。",
@@ -3976,11 +3989,11 @@
     "Simple mode only returns message; status code and error type use system defaults.": "简洁模式仅返回 message；状态码和错误类型将使用系统默认值。",
     "Simple mode: prune objects by type, e.g. redacted_thinking.": "简洁模式：按 type 全量清理对象，例如 redacted_thinking。",
     "Single Key": "单密钥",
-    "Skip async task polling delay": "跳过异步任务轮询延迟",
     "Site & Branding": "站点与品牌",
     "Site Key": "站点密钥",
     "Size:": "大小：",
     "sk_xxx or rk_xxx": "sk_xxx 或 rk_xxx",
+    "Skip async task polling delay": "跳过异步任务轮询延迟",
     "Skip retry on failure": "失败后不重试",
     "Skip SMTP TLS certificate verification": "跳过 SMTP TLS 证书验证",
     "Skip to Main": "跳到主内容",
@@ -4206,6 +4219,7 @@
     "Test all {{count}} models": "测试全部 {{count}} 个模型",
     "Test All Channels": "测试所有渠道",
     "Test Channel Connection": "测试渠道连接",
+    "Test channels, refresh balances, and enable/disable individual, batch, or tagged channels.": "测试渠道、刷新余额，并启用/禁用单个、批量或带标签的渠道。",
     "Test Connection": "测试连接",
     "Test connectivity for:": "测试连接性：",
     "Test failed": "测试失败",
@@ -4739,6 +4753,8 @@
     "Vidu": "Vidu",
     "View": "查看",
     "View all currently available models": "查看当前可用的所有模型",
+    "View channel lists and details without secrets.": "查看不含密钥的渠道列表和详情。",
+    "View channel secrets": "查看渠道密钥",
     "View detailed information about this user including balance, usage statistics, and invitation details.": "查看此用户的详细信息，包括余额、使用统计和邀请详情。",
     "View details": "查看详情",
     "View document": "查看文档",
@@ -4881,8 +4897,10 @@
     "You can close this tab once the binding completes or a success message appears in the original window.": "绑定完成后或原窗口出现成功消息后，您可以关闭此标签页。",
     "You can manually add them in \"Custom Model Names\", click \"Fill\" and then submit, or use the operations below to handle automatically.": "你可以在\"自定义模型名称\"处手动添加它们，然后点击\"填入\"后再提交，或者直接使用下方操作自动处理。",
     "You can only check in once per day": "每日仅可签到一次，请勿重复签到",
+    "You can still edit non-sensitive operations fields such as models, groups, priority, and weight.": "你仍可编辑模型、分组、优先级和权重等非敏感运维字段。",
     "You commit not to use this system to implement, assist with, or indirectly implement acts that violate applicable laws and regulations, regulatory requirements, platform rules, public interests, or the lawful rights and interests of third parties.": "你承诺不会使用本系统实施、协助实施或间接实施违反适用法律法规、监管要求、平台规则、公共利益或第三方合法权益的行为。",
     "You commit to using upstream APIs, accounts, keys, quotas, and service capabilities only within the scope of lawful authorization obtained from upstream service providers, model service providers, or relevant rights holders, and will not conduct unauthorized resale, trafficking, distribution, or other non-compliant commercialization.": "你承诺仅在从上游服务提供商、模型服务提供商或相关权利人处获得合法授权的范围内使用上游 API、账户、密钥、额度和服务能力，并不会进行未经授权的转售、倒卖、分发或其他不合规商业化行为。",
+    "You do not have permission to edit sensitive channel settings.": "你没有权限编辑敏感渠道设置。",
     "You don't have necessary permission": "您没有必要的权限",
     "You have legally obtained authorization for the connected model APIs, accounts, keys, and quotas.": "你已合法取得所连接模型 API、账户、密钥和额度的授权。",
     "You have unsaved changes": "您有未保存的更改",
@@ -4893,6 +4911,8 @@
     "You understand this compliance reminder is only for risk notice and does not constitute legal advice, a compliance review conclusion, or a guarantee of the legality of your use of this system; you should consult professional legal or compliance advisors based on your actual business scenario.": "你理解此合规提醒仅用于风险提示，不构成法律意见、合规审查结论或对你使用本系统合法性的保证；你应结合实际业务场景咨询专业法律或合规顾问。",
     "You will be redirected to Telegram to complete the binding process.": "您将被重定向到 Telegram 以完成绑定过程。",
     "You'll be redirected automatically. You can return to the previous page if nothing happens after a few seconds.": "您将被自动重定向。如果几秒钟后无反应，您可以返回上一页。",
+    "Your account can edit sensitive channel settings.": "你的账号可以编辑敏感渠道设置。",
+    "Your account cannot edit sensitive channel settings.": "你的账号不能编辑敏感渠道设置。",
     "your AI integration?": "你的 AI 集成了吗？",
     "Your Azure OpenAI endpoint URL": "您的 Azure OpenAI 端点 URL",
     "Your Bot Name": "您的机器人名称",