feat(admin): 优化用户权限分级·统一头像·数据分析面板修复

- fix(DataAnalysisPanel): 活跃用户卡片固定 400px + overflow-y 独立滚动容器，底部渐变遮罩提示滚动；列表项 tooltip 增加 max-height 与 overflow 截断；新增圆形头像显示与 @error 回退首字母
- feat(admin): 新增 getUserAvatarUrl 统一头像策略链（OAuth identity→Gravatar→DiceBear 7.x initials），stats/realtime、active-users、users/index 三处接口返回 avatarUrl
- fix(admin): 建立 SUPER_ADMIN(100)>ADMIN(80)>USER(10) 分级常量与 canChangeRoleOf/canResetPasswordFor 等谓词；reset-password、[id].put、index.post 全面应用级别守卫；前端 UserManager 按钮按权限禁用、availableRoles 按操作者级别过滤 SUPER_ADMIN/ADMIN 等高角色

server/api/admin/users/[id]/reset-password.post.ts

@@ -1,16 +1,18 @@
 import { updateUserPassword } from '~~/server/services/userService'
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+import { canResetPasswordFor, getRoleLevel } from '../../../utils/permissions.js'
 
 export default defineEventHandler(async (event) => {
-  // 检查认证和权限
-  const user = event.context.user
-  if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
+  const currentUser = event.context.user
+  if (!currentUser || !['ADMIN', 'SUPER_ADMIN'].includes(currentUser.role)) {
     throw createError({
       statusCode: 403,
       message: '没有权限访问'
     })
   }
 
-  // 安全获取ID参数
   const params = event.context.params || {}
   const id = parseInt(params.id || '')
 
@@ -31,15 +33,54 @@ export default defineEventHandler(async (event) => {
   }
 
   try {
-    // 禁止对自身进行密码重置（通过用户管理界面）
-    if (id === user.id) {
+    if (id === currentUser.id) {
       throw createError({
         statusCode: 400,
         message: '禁止在用户管理中重置自己的密码'
       })
     }
-    
-    // 使用统一服务重置密码 (forceReset = true)
+
+    const targetUserResult = await db
+      .select({ id: users.id, role: users.role, username: users.username })
+      .from(users)
+      .where(eq(users.id, id))
+      .limit(1)
+
+    if (targetUserResult.length === 0) {
+      throw createError({
+        statusCode: 404,
+        message: '用户不存在'
+      })
+    }
+
+    const targetUser = targetUserResult[0]
+
+    if (targetUser.id === 1) {
+      throw createError({
+        statusCode: 403,
+        message: '无法重置系统初始超级管理员的密码'
+      })
+    }
+
+    const currentLevel = getRoleLevel(currentUser.role)
+    const targetLevel = getRoleLevel(targetUser.role)
+
+    if (currentUser.role !== 'SUPER_ADMIN') {
+      if (currentLevel <= targetLevel) {
+        throw createError({
+          statusCode: 403,
+          message: '权限不足：不能重置角色级别大于等于自己的用户密码'
+        })
+      }
+    }
+
+    if (!canResetPasswordFor(currentUser, targetUser)) {
+      throw createError({
+        statusCode: 403,
+        message: '权限不足：当前角色无法重置该用户的密码'
+      })
+    }
+
     await updateUserPassword(id, body.newPassword, true)
 
     return {
@@ -47,7 +88,10 @@ export default defineEventHandler(async (event) => {
       message: '密码重置成功'
     }
   } catch (error) {
-    console.error('重置密码失败:', error)
+    console.error('[ResetPassword] 失败:', error)
+    if (error.statusCode) {
+      throw error
+    }
     throw createError({
       statusCode: 500,
       message: '重置密码失败'