fix(cfc-backend): add role-based permission checks to activity endpoints

Restrict create, update, publish, and end endpoints to admin and activity_admin roles only. Previously any logged-in user could manage activities.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

cfc-backend/src/main/java/com/etotem/cfc/controller/ActivityController.java

@@ -31,16 +31,31 @@ public class ActivityController {
     }
 
     @PostMapping("/create")
-    public Result<ActivityDTO> create(@RequestBody Activity activity, @RequestAttribute(value = "userId", required = false) Long userId) {
+    public Result<ActivityDTO> create(@RequestBody Activity activity,
+                                       @RequestAttribute(value = "userId", required = false) Long userId,
+                                       @RequestAttribute("role") String role) {
+        if (!"admin".equals(role) && !"activity_admin".equals(role)) {
+            return Result.error("只有管理员或活动管理员可以创建活动");
+        }
         if (userId != null) activity.setVendorId(userId);
         return activityService.create(activity);
     }
 
     @PostMapping("/update")
-    public Result<ActivityDTO> update(@RequestBody Activity activity) { return activityService.update(activity); }
+    public Result<ActivityDTO> update(@RequestBody Activity activity,
+                                       @RequestAttribute("role") String role) {
+        if (!"admin".equals(role) && !"activity_admin".equals(role)) {
+            return Result.error("只有管理员或活动管理员可以修改活动");
+        }
+        return activityService.update(activity);
+    }
 
     @PostMapping("/publish")
-    public Result<String> publish(@RequestBody Map<String, Object> params) {
+    public Result<String> publish(@RequestBody Map<String, Object> params,
+                                   @RequestAttribute("role") String role) {
+        if (!"admin".equals(role) && !"activity_admin".equals(role)) {
+            return Result.error("只有管理员或活动管理员可以发布活动");
+        }
         Long id = params.get("id") != null ? Long.valueOf(params.get("id").toString()) : null;
         if (id == null) return Result.error("id不能为空");
         try {
@@ -51,7 +66,11 @@ public class ActivityController {
     }
 
     @PostMapping("/end")
-    public Result<String> end(@RequestBody Map<String, Object> params) {
+    public Result<String> end(@RequestBody Map<String, Object> params,
+                               @RequestAttribute("role") String role) {
+        if (!"admin".equals(role) && !"activity_admin".equals(role)) {
+            return Result.error("只有管理员或活动管理员可以结束活动");
+        }
         Long id = params.get("id") != null ? Long.valueOf(params.get("id").toString()) : null;
         if (id == null) return Result.error("id不能为空");
         return activityService.end(id);