checkpoint: 权限即时生效——角色/用户变更自动踢下线 + roleless 用户自读修复

- online/service: kick_user_sessions 扫描 USER_SESSION 匹配目标用户，删三键使登录时固化的权限快照即时失效
- role service+controller: 更新/删除/改状态/改权限后踢下线绑定该角色的用户
- user service+controller: 停用/改密等变更后踢下线（对应用户即时 401 重登）
- permission: 无角色用户读自身记录时按 id 匹配放行（修复 409 真 bug）

backend/app/core/permission.py

@@ -48,6 +48,10 @@ class Permission:
         roles = result.scalars().all()
 
         if not roles:
+            if self.model.__name__ == "UserModel":
+                id_attr = getattr(self.model, "id", None)
+                if id_attr is not None and self.auth.user and self.auth.user.id:
+                    return id_attr == self.auth.user.id
             created_id_attr = getattr(self.model, "created_id", None)
             if created_id_attr is not None and self.auth.user and self.auth.user.id:
                 return created_id_attr == self.auth.user.id