fix: restructure menu permissions by role

- 用户管理: *.admin roles (any role with .admin suffix)
- 租户管理: reseller.operator or owner.superuser
- 系统权限管理: owner.superuser only
- 基础配置: owner.superuser only

wwwroot/global_menu.ui

@@ -3,6 +3,8 @@
 {% set is_customer = 'customer.' in role_str %}
 {% set is_customer_admin = 'customer.admin' in roles %}
 {% set is_superuser = 'owner.superuser' in roles %}
+{% set is_reseller_operator = 'reseller.operator' in roles %}
+{% set is_any_admin = '.admin' in role_str %}
 {
     "widgettype": "Menu",
     "id": "global_nav_menu",
@@ -366,6 +368,8 @@
                     }
                 ]
             }
+{% endif %}
+            {% if is_any_admin %}
             ,{
                 "name": "users",
                 "label": "用户管理",
@@ -373,6 +377,17 @@
                 "url": "{{entire_url('/rbac/users')}}",
                 "target": "app.sage_main_content"
             }
+{% endif %}
+            {% if is_reseller_operator or is_superuser %}
+            ,{
+                "name": "tenant_manage",
+                "label": "租户管理",
+                "icon": "{{entire_url('/imgs/globe.svg')}}",
+                "url": "{{entire_url('/tenant/')}}",
+                "target": "app.sage_main_content"
+            }
+{% endif %}
+            {% if is_superuser %}
             ,{
                 "name": "system_permission",
                 "label": "系统权限管理",
@@ -398,15 +413,6 @@
                     }
                 ]
             }
-            ,{
-                "name": "tenant_manage",
-                "label": "租户管理",
-                "icon": "{{entire_url('/imgs/globe.svg')}}",
-                "url": "{{entire_url('/tenant/')}}",
-                "target": "app.sage_main_content"
-            }
-{% endif %}
-            {% if is_superuser %}
             ,{
                 "name": "sys_config",
                 "label": "基础配置",