feat: 增加工作流和知识库三级权限

- 抽取统一资源访问骨架与部门可见范围判断

- 接入工作流和知识库的 READ/MANAGE 权限校验

- 增加可见范围配置与只读态前端交互

easyflow-modules/easyflow-module-system/src/main/java/tech/easyflow/system/enums/ResourceAction.java

@@ -0,0 +1,7 @@
+package tech.easyflow.system.enums;
+
+public enum ResourceAction {
+    READ,
+    USE,
+    MANAGE
+}

easyflow-modules/easyflow-module-system/src/main/java/tech/easyflow/system/enums/ResourceLookup.java

@@ -0,0 +1,12 @@
+package tech.easyflow.system.enums;
+
+public enum ResourceLookup {
+    WORKFLOW_ID,
+    EXEC_KEY,
+    KNOWLEDGE_ID,
+    KNOWLEDGE_ID_OR_SLUG,
+    DOCUMENT_ID,
+    DOCUMENT_CHUNK_ID,
+    FAQ_ITEM_ID,
+    FAQ_CATEGORY_ID
+}

easyflow-modules/easyflow-module-system/src/main/java/tech/easyflow/system/enums/VisibilityScope.java

@@ -0,0 +1,29 @@
+package tech.easyflow.system.enums;
+
+import java.util.Arrays;
+import java.util.Locale;
+
+public enum VisibilityScope {
+
+    PRIVATE,
+    DEPT,
+    PUBLIC;
+
+    public static VisibilityScope from(String code) {
+        if (code == null || code.isBlank()) {
+            throw new IllegalArgumentException("visibilityScope不能为空");
+        }
+        String normalized = code.trim().toUpperCase(Locale.ROOT);
+        return Arrays.stream(values())
+                .filter(item -> item.name().equals(normalized))
+                .findFirst()
+                .orElseThrow(() -> new IllegalArgumentException("不支持的visibilityScope: " + code));
+    }
+
+    public static VisibilityScope fromOrDefault(String code, VisibilityScope defaultValue) {
+        if (code == null || code.isBlank()) {
+            return defaultValue;
+        }
+        return from(code);
+    }
+}