feat(admin): Complete tenant management and module access control system

Major Features:
- Tenant management CRUD (list, create, edit, delete, module configuration)
- Dynamic module management system (modules table with 8 modules)
- Multi-tenant module permission merging (ModuleService)
- Module access control middleware (requireModule)
- User module permission API (GET /api/v1/auth/me/modules)
- Frontend module permission filtering (HomePage + TopNavigation)

Module Integration:
- RVW module integrated with PromptService (editorial + methodology)
- All modules (RVW/PKB/ASL/DC) added authenticate + requireModule middleware
- Fixed ReviewTask foreign key constraint (cross-schema issue)
- Removed all MOCK_USER_ID, unified to request.user?.userId

Prompt Management Enhancements:
- Module names displayed in Chinese (RVW -> 智能审稿)
- Enhanced version history with view content and rollback features
- List page shows both activeVersion and draftVersion columns

Database Changes:
- Added platform_schema.modules table
- Modified tenant_modules table (added index and UUID)
- Removed ReviewTask foreign key to public.users (cross-schema fix)
- Seeded 8 modules: RVW, PKB, ASL, DC, IIT, AIA, SSA, ST

Documentation Updates:
- Updated ADMIN module development status
- Updated TODO checklist (89% progress)
- Updated Prompt management plan (Phase 3.5.5 completed)
- Added module authentication specification

Files Changed: 80+
Status: All features tested and verified locally
Next: User management module development

backend/src/modules/dc/tool-c/controllers/SessionController.ts

@@ -20,6 +20,17 @@ import { dataProcessService } from '../services/DataProcessService.js';
 import { jobQueue } from '../../../../common/jobs/index.js';
 import * as xlsx from 'xlsx';
 
+/**
+ * 获取用户ID（从JWT Token中获取）
+ */
+function getUserId(request: FastifyRequest): string {
+  const userId = (request as any).user?.userId;
+  if (!userId) {
+    throw new Error('User not authenticated');
+  }
+  return userId;
+}
+
 // ==================== 请求参数类型定义 ====================
 
 interface SessionIdParams {
@@ -69,9 +80,8 @@ export class SessionController {
         });
       }
 
-      // 4. 获取用户ID（从请求中提取，实际部署时从JWT获取）
-      // TODO: 从JWT token中获取userId
-      const userId = (request as any).userId || 'test-user-001';
+      // 4. 获取用户ID
+      const userId = getUserId(request);
 
       // 5. 创建Session（Postgres-Only架构 - 异步处理）
       const sessionResult = await sessionService.createSession(