feat: implement full RBAC role-based access control

Backend:
- deps.py: add require_admin, require_manager, require_labeler, require_guest_or_above
- user.py: all write endpoints require admin
- datasource.py: write/sync endpoints require admin
- metadata.py: sync endpoint requires admin
- classification.py: category/rule write requires admin; results query requires guest+ with data isolation
- project.py: GET requires manager with created_by filtering; DELETE checks ownership
- task.py: my-tasks requires labeler with assignee_id filtering; create-task requires manager
- dashboard.py: requires guest_or_above
- report.py: requires guest_or_above
- project_service: list_projects adds created_by filter; list_results adds project_ids filter

Frontend:
- stores/user.ts: add hasRole, hasAnyRole, isAdmin, isManager, isLabeler, isSuperadmin
- router/index.ts: add roles to route meta; beforeEach checks role permissions
- Layout.vue: filter menu routes by user roles
- System.vue: hide add/edit/delete buttons for non-admins
- DataSource.vue: hide add/edit/delete/sync buttons for non-admins
- Project.vue: hide add/delete buttons for non-admins

backend/app/services/project_service.py

@@ -12,11 +12,13 @@ def get_project(db: Session, project_id: int) -> Optional[ClassificationProject]
 
 
 def list_projects(
-    db: Session, keyword: Optional[str] = None, page: int = 1, page_size: int = 20
+    db: Session, keyword: Optional[str] = None, page: int = 1, page_size: int = 20, created_by: Optional[int] = None
 ) -> Tuple[List[ClassificationProject], int]:
     query = db.query(ClassificationProject)
     if keyword:
         query = query.filter(ClassificationProject.name.contains(keyword))
+    if created_by:
+        query = query.filter(ClassificationProject.created_by == created_by)
     total = query.count()
     items = query.order_by(ClassificationProject.created_at.desc()).offset((page - 1) * page_size).limit(page_size).all()
     return items, total
@@ -82,10 +84,13 @@ def list_results(
     keyword: Optional[str] = None,
     page: int = 1,
     page_size: int = 50,
+    project_ids: Optional[List[int]] = None,
 ) -> Tuple[List[ClassificationResult], int]:
     query = db.query(ClassificationResult)
     if project_id:
         query = query.filter(ClassificationResult.project_id == project_id)
+    if project_ids:
+        query = query.filter(ClassificationResult.project_id.in_(project_ids))
     if table_id:
         query = query.join(DataColumn).filter(DataColumn.table_id == table_id)
     if status: