Merge remote-tracking branch 'origin/main' into fix/role-editor-single-project-toggle

Why: Owner reported that creating a role showed system admin permissions. The
server rejects protected system-scope actions for role writes anyway; they are
only configurable per account in the users panel, so showing them in the role
editor is misleading.

Evidence: npm run build passes and npx vitest run passes (717 tests); the two
account-panel tests that assert system capability groups keep passing because the
filter lives at the role editor call site, not in buildCapabilityGroups. The
agent-exec transport diff matches the owner-accepted change.

Impact: the role editor builds capability groups without system.* actions; the
per-account explicit grant surface is unchanged.

Refs: fix/role-editor-single-project-toggle

src/components/RolePermissionsPanel.tsx

@@ -143,7 +143,11 @@ export function RolePermissionsPanel() {
   const allEditableIds = useMemo(() => catalog.filter(item => !item.protected).map(item => item.actionId), [catalog])
   const dirty = !!draft && visiblePatch(draft, allEditableIds).length > 0
   const filtered = roles ?? []
-  const capabilityGroups = useMemo(() => buildCapabilityGroups(catalog.filter(item => !item.protected)), [catalog])
+  // 角色只承载项目范围动作：受保护的系统授权由服务端整批拒绝，
+  // 在角色编辑面展示只会误导（账号级显式授权仍在用户面板单独配置）。
+  const capabilityGroups = useMemo(
+    () => buildCapabilityGroups(catalog.filter(item => !item.protected && item.actionId.indexOf('system.') !== 0)),
+    [catalog])
   const labels = useMemo(() => Object.fromEntries(catalog.map(item => [item.actionId, item.label])), [catalog])
   const changes = draft ? capabilityGroupChanges(draft, capabilityGroups) : []
   const breaks = draft ? linkedChainBreaks(draft.values) : []