feat(admin): 优化用户权限分级·统一头像·数据分析面板修复

- fix(DataAnalysisPanel): 活跃用户卡片固定 400px + overflow-y 独立滚动容器，底部渐变遮罩提示滚动；列表项 tooltip 增加 max-height 与 overflow 截断；新增圆形头像显示与 @error 回退首字母
- feat(admin): 新增 getUserAvatarUrl 统一头像策略链（OAuth identity→Gravatar→DiceBear 7.x initials），stats/realtime、active-users、users/index 三处接口返回 avatarUrl
- fix(admin): 建立 SUPER_ADMIN(100)>ADMIN(80)>USER(10) 分级常量与 canChangeRoleOf/canResetPasswordFor 等谓词；reset-password、[id].put、index.post 全面应用级别守卫；前端 UserManager 按钮按权限禁用、availableRoles 按操作者级别过滤 SUPER_ADMIN/ADMIN 等高角色

server/api/admin/stats/active-users.get.ts

@@ -1,10 +1,10 @@
 import { createError, defineEventHandler, getQuery } from 'h3'
 import { db } from '~/drizzle/db'
-import { songs, users, votes } from '~/drizzle/schema'
+import { songs, users, votes, userIdentities } from '~/drizzle/schema'
 import { CacheService } from '../../../services/cacheService'
+import { getUserAvatarUrl } from '../../../utils/user-avatar'
 
 export default defineEventHandler(async (event) => {
-  // 检查认证和权限
   const user = event.context.user
   if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
     throw createError({
@@ -18,7 +18,6 @@ export default defineEventHandler(async (event) => {
   const limit = parseInt(query.limit as string) || 20
 
   try {
-    // 尝试从缓存获取数据
     const cacheService = CacheService.getInstance()
     const cachedStats = await cacheService.getActiveUsersStats(semester, limit)
     if (cachedStats) {
@@ -26,18 +25,24 @@ export default defineEventHandler(async (event) => {
       return cachedStats
     }
 
-    // 构建查询条件 - 如果没有指定学期或学期为'all'，查询所有用户
     let songWhere = {}
     if (semester && semester !== 'all') {
       songWhere = { semester: semester }
     }
 
-    // 获取活跃用户数据 - 有投稿歌曲的用户
     const allUsers = await db.select().from(users)
     const allSongs = await db.select().from(songs)
     const allVotes = await db.select().from(votes)
+    const allIdentities = await db.select().from(userIdentities)
+
+    const identitiesMap = new Map<number, typeof allIdentities>()
+    allIdentities.forEach((identity) => {
+      if (!identitiesMap.has(identity.userId)) {
+        identitiesMap.set(identity.userId, [])
+      }
+      identitiesMap.get(identity.userId)!.push(identity)
+    })
 
-    // 过滤有投稿歌曲的用户
     const activeUsers = allUsers
       .filter((user) => {
         const userSongs = allSongs.filter((song) => {
@@ -65,44 +70,48 @@ export default defineEventHandler(async (event) => {
         }
       })
 
-    // 如果没有活跃用户，返回空数组
     if (activeUsers.length === 0) {
       const emptyResult = []
-      // 缓存空结果
       await cacheService.setActiveUsersStats(semester, limit, emptyResult)
       console.log('[Cache] 活跃用户统计数据已缓存（空结果）')
       return emptyResult
     }
 
-    // 计算每个用户的活跃度数据
     const userStats = activeUsers.map((user) => {
       const contributions = user.songs.length
       const likes = user.songs.reduce((total, song) => total + song.votes.length, 0)
-
-      // 活跃度计算：投稿数 * 2 + 点赞数 * 0.5
       const activityScore = Math.round(contributions * 2 + likes * 0.5)
+      const userIdentitiesData = identitiesMap.get(user.id) || []
+      const avatarUrl = getUserAvatarUrl(
+        {
+          id: user.id,
+          name: user.name,
+          username: user.username,
+          email: user.email,
+          avatarProvider: user.avatarProvider,
+          avatarProviderUserId: user.avatarProviderUserId
+        },
+        userIdentitiesData
+      )
 
-      const userStat = {
+      return {
         id: user.id,
-        name: user.name || user.username, // 优先显示真实姓名，如果没有则显示登录名
+        name: user.name || user.username,
         contributions,
         likes,
-        activityScore
+        activityScore,
+        avatarUrl
       }
-
-      return userStat
     })
 
-    // 按活跃度分数降序排列并限制数量
     const sortedUsers = userStats.sort((a, b) => b.activityScore - a.activityScore).slice(0, limit)
 
-    // 缓存结果
     await cacheService.setActiveUsersStats(semester, limit, sortedUsers)
     console.log('[Cache] 活跃用户统计数据已缓存')
 
     return sortedUsers
   } catch (error) {
-    // 返回空数组而不是抛出错误，避免前端显示错误
+    console.error('[Stats] 获取活跃用户失败:', error)
     return []
   }
 })