[MercuialC]

Description

为租户 API Key 增加按知识库的可读 / 可写 / 可管理授权，并在 GET /knowledge-bases 返回 permission 字段，方便调用方按库判断权限。

已有 Key 保持兼容：knowledge_base_permissions 为空对象 {} 时，白名单内每个知识库仍继承该 Key 的全局 retrieve / ingest / manage_kbs。

Type of Change

• ✨ New feature

Related Issue

Fixes #3276

Testing

• go test ./internal/types ./internal/handler ./internal/middleware ./internal/application/service ./internal/application/repository ./internal/database -count=1
• 前端：apiKeyScope.test.ts 覆盖分库矩阵默认值
• 手工：创建带范围的 Key，取消某个库的「可编辑」，确认 ingest 返回 403，且列表里该库 permission.write=false

Checklist

• Targeted tests for the changed packages pass
• Added/updated tests covering the change
• Updated related documentation (docs/api/knowledge-base.md, website-docs/)
• Self-reviewed the code
• git diff --check origin/main...HEAD passes
• Diff-scoped lint (golangci-lint run --new-from-rev=origin/main ./...)
• Full-repository checks were run, or unrelated failures documented above

Screenshots / Recordings

API 集成设置：选中知识库后的分库矩阵（可读 / 可编辑 / 可管理）。