checkpoint: 权限即时生效——角色/用户变更自动踢下线 + roleless 用户自读修复

- online/service: kick_user_sessions 扫描 USER_SESSION 匹配目标用户，删三键使登录时固化的权限快照即时失效
- role service+controller: 更新/删除/改状态/改权限后踢下线绑定该角色的用户
- user service+controller: 停用/改密等变更后踢下线（对应用户即时 401 重登）
- permission: 无角色用户读自身记录时按 id 匹配放行（修复 409 真 bug）

backend/app/api/v1/module_system/user/controller.py

@@ -56,9 +56,10 @@ async def update_current_user_info_controller(
 async def change_current_user_password_controller(
     auth: Annotated[AuthSchema, Depends(get_current_user)],
     db: Annotated[AsyncSession, Depends(db_getter)],
+    redis: Annotated[Redis, Depends(redis_getter)],
     data: Annotated[UserChangePasswordSchema, Body(description="修改用户密码参数")],
 ) -> JSONResponse:
-    result_dict = await UserService(auth, db).change_password(data=data)
+    result_dict = await UserService(auth, db).change_password(data=data, redis=redis)
     return SuccessResponse(data=result_dict, msg="修改密码成功, 请重新登录")
 
 
@@ -66,11 +67,12 @@ async def change_current_user_password_controller(
 async def reset_password_controller(
     auth: Annotated[AuthSchema, Security(AuthPermission(["module_system:user:update"]))],
     db: Annotated[AsyncSession, Depends(db_getter)],
+    redis: Annotated[Redis, Depends(redis_getter)],
     id: Annotated[int, Path(description="用户ID", ge=1)],
     data: Annotated[ResetPasswordSchema, Body(description="重置用户密码参数")],
 ) -> JSONResponse:
     data.id = id
-    result_dict = await UserService(auth, db).reset_password(data=data)
+    result_dict = await UserService(auth, db).reset_password(data=data, redis=redis)
     return SuccessResponse(data=result_dict, msg="重置密码成功")
 
 
@@ -159,10 +161,11 @@ async def create_user_controller(
 async def update_user_controller(
     auth: Annotated[AuthSchema, Security(AuthPermission(["module_system:user:update"]))],
     db: Annotated[AsyncSession, Depends(db_getter)],
+    redis: Annotated[Redis, Depends(redis_getter)],
     id: Annotated[int, Path(description="用户ID")],
     data: Annotated[UserUpdateSchema, Body(description="修改用户参数")],
 ) -> JSONResponse:
-    result_dict = await UserService(auth, db).update(id=id, data=data)
+    result_dict = await UserService(auth, db).update(id=id, data=data, redis=redis)
     return SuccessResponse(data=result_dict, msg="修改用户成功")
 
 
@@ -170,9 +173,10 @@ async def update_user_controller(
 async def delete_user_controller(
     auth: Annotated[AuthSchema, Security(AuthPermission(["module_system:user:delete"]))],
     db: Annotated[AsyncSession, Depends(db_getter)],
+    redis: Annotated[Redis, Depends(redis_getter)],
     ids: Annotated[list[int], Body(description="ID列表")],
 ) -> JSONResponse:
-    await UserService(auth, db).delete(ids=ids)
+    await UserService(auth, db).delete(ids=ids, redis=redis)
     return SuccessResponse(msg="删除用户成功")
 
 
@@ -180,9 +184,10 @@ async def delete_user_controller(
 async def batch_set_available_user_controller(
     auth: Annotated[AuthSchema, Security(AuthPermission(["module_system:user:patch"]))],
     db: Annotated[AsyncSession, Depends(db_getter)],
+    redis: Annotated[Redis, Depends(redis_getter)],
     data: Annotated[BatchSetAvailable, Body(description="状态设置")],
 ) -> JSONResponse:
-    await UserService(auth, db).set_available(data=data)
+    await UserService(auth, db).set_available(data=data, redis=redis)
     return SuccessResponse(msg="批量修改用户状态成功")