feat(工作流)：支持本地图编排策略包导入导出 (#195)

* docs: define local workflow package mvp

* docs: fix workflow package api contract

* feat: add local workflow package mvp

* feat(workflow): add package API client

* feat(workflow): add package import interface

* feat(workflow): connect package import flow

* fix(workflow): map package validation errors

* fix(workflow): handle import key generation errors

* feat(workflow): localize package import states

* fix(workflow): reset package import modal on open

---------

Co-authored-by: ruanmingchen <“ruanm@chenchen”>

internal/security/rbac_middleware.go

@@ -164,6 +164,10 @@ func permissionForRequest(method, fullPath string) string {
 		return crudPermission(method, "files")
 	case strings.HasPrefix(path, "/roles"):
 		return crudPermission(method, "roles")
+	case path == "/workflows/:id/package":
+		return "workflow:read"
+	case strings.HasPrefix(path, "/workflow-package-inspections"), strings.HasPrefix(path, "/workflow-package-imports"):
+		return "workflow:write"
 	case strings.HasPrefix(path, "/workflows"):
 		if path == "/workflows/validate" || path == "/workflows/dry-run" || strings.HasSuffix(path, "/resume") {
 			return "workflow:execute"
@@ -257,6 +261,9 @@ func isProcessGlobalMutationPath(path string) bool {
 		// Workflow runs inherit conversation access; definitions are global.
 		return !strings.HasPrefix(path, "/workflows/runs/") && path != "/workflows/validate" && path != "/workflows/dry-run"
 	}
+	if strings.HasPrefix(path, "/workflow-package-inspections") || strings.HasPrefix(path, "/workflow-package-imports") {
+		return true
+	}
 	if strings.HasPrefix(path, "/knowledge") {
 		return path != "/knowledge/search"
 	}