Why: Owner reported that creating a role showed system admin permissions. The
server rejects protected system-scope actions for role writes anyway; they are
only configurable per account in the users panel, so showing them in the role
editor is misleading.
Evidence: npm run build passes and npx vitest run passes (717 tests); the two
account-panel tests that assert system capability groups keep passing because the
filter lives at the role editor call site, not in buildCapabilityGroups. The
agent-exec transport diff matches the owner-accepted change.
Impact: the role editor builds capability groups without system.* actions; the
per-account explicit grant surface is unchanged.
Refs: fix/role-editor-single-project-toggle
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why
owner 反馈角色创建里全是管理员权限。服务端对受保护系统范围动作本就整批拒绝，只能按用户单独授予，角色编辑面展示只会误导。
Evidence
Impact
角色编辑面不再出现 system.* 动作；账号级显式授权界面不变。
Refs
fix/role-editor-single-project-toggle