feat(frontend): add Helm chart browser, monitoring, chart-references and values templates pages

Add new frontend pages for the multi-tenant OCDP platform:

- Charts page (/charts): Browse Harbor OCI registries to list Helm chart repositories
  and versions, with deploy modal to launch charts on selected clusters
- Monitoring page (/monitoring): Display cluster metrics (CPU/Memory/GPU usage)
  and per-node details with resource utilization bars
- Chart References page (/chart-references): CRUD for chart metadata references
- Values Templates page (/templates): CRUD for Helm values templates with version
  history and rollback support
- Sidebar: Add Charts navigation, update Storage and Templates links
- api.ts: Add all API client functions (clusterApi, registryApi, instanceApi,
  monitoringApi, storageApi, chartReferenceApi, valuesTemplateApi,
  workspaceApi, userApi) with full TypeScript types

Note: deploy flow and values template rollback not yet end-to-end tested.

backend/internal/domain/service/auth_service.go

@@ -22,9 +22,9 @@ type PasswordHasher interface {
 
 // TokenGenerator Token 生成器接口
 type TokenGenerator interface {
-	Generate(userID, username string) (accessToken, refreshToken string, err error)
-	Verify(token string) (userID, username string, err error)
-	VerifyWithIssuedAt(token string) (userID, username string, issuedAt int64, err error)
+	Generate(userID, username, role, workspaceID string) (accessToken, refreshToken string, err error)
+	Verify(token string) (userID, username, role, workspaceID string, err error)
+	VerifyWithIssuedAt(token string) (userID, username, role, workspaceID string, issuedAt int64, err error)
 	Refresh(refreshToken string) (newAccessToken string, err error)
 }
 
@@ -86,8 +86,8 @@ func (s *AuthService) Login(ctx context.Context, username, password string) (acc
 		return "", "", entity.ErrInvalidPassword
 	}
 
-	// 生成 Token
-	accessToken, refreshToken, err = s.tokenGenerator.Generate(user.ID, user.Username)
+	// 生成 Token (包含 role 和 workspace_id)
+	accessToken, refreshToken, err = s.tokenGenerator.Generate(user.ID, user.Username, string(user.Role), user.WorkspaceID)
 	if err != nil {
 		return "", "", err
 	}
@@ -108,7 +108,7 @@ func (s *AuthService) GetUserByID(ctx context.Context, id string) (*entity.User,
 // VerifyAccessToken 验证 Access Token（包括 revoked_after 检查）
 func (s *AuthService) VerifyAccessToken(ctx context.Context, token string) (userID, username string, err error) {
 	// 1. JWT 自验证
-	userID, username, issuedAt, err := s.tokenGenerator.VerifyWithIssuedAt(token)
+	userID, username, _, _, issuedAt, err := s.tokenGenerator.VerifyWithIssuedAt(token)
 	if err != nil {
 		return "", "", err
 	}