v0.13.0

• Feat (breaking, template) Modern <Access> permission system. Replaces the previous <PermissionWrapper> + requiredPermissions array convention with a hybrid RBAC + fine-grained model that mirrors ant-design-pro's <Access> API:
  • src/auth/access.tsx — defineAccess(userInfo) factory + useAccess() hook + <Access accessible fallback> component. All boolean flags consumed by the UI live in one place; backend shape changes are a one-file edit.
  • Backend shape: userInfo now exposes both roles: string[] (coarse RBAC) and permissions?: Record<string, string[]> (optional fine-grained overlay). The frontend defineAccess uses both — most flags resolve from roles alone, occasional can(resource, action) checks cover "give this user one extra capability outside their role" cases.
  • src/routes.ts: route nodes carry an access?: (a: AccessMap) => boolean predicate instead of requiredPermissions: [{ resource, actions }]. Cleaner type-checked references to central flags.
  • src/auth/ProtectedRoute.tsx gains a requireAccess prop for route-level gating with redirect to /exception/403 (override via denyRedirect).
  • Migrated 3 call sites in pages/list/{search-table,card} to use <Access accessible={access.canX}>.
  • Removed src/components/PermissionWrapper/ and src/utils/authentication.ts — no backward-compat shim.