feat: 算力引擎 Go 后端核心（new-api）

- 统一 OpenAI 兼容 /v1 中继 + 渠道/额度/令牌/流水
- 各领域包：relay 模型网关、model 数据层、controller 管理 API

service/authz/assignment.go

@@ -0,0 +1,20 @@
+package authz
+
+import "github.com/QuantumNous/new-api/common"
+
+// resolveSubjectRoles returns the role keys assigned to a subject. The mapping
+// is derived from the caller's system role.
+var resolveSubjectRoles = func(userID int, systemRole int) []string {
+	switch {
+	case systemRole >= common.RoleRootUser:
+		return []string{BuiltInRoleRoot}
+	case systemRole >= common.RoleAdminUser:
+		return []string{BuiltInRoleAdmin}
+	default:
+		return nil
+	}
+}
+
+// managedRoleKey is the role whose baseline per-user overrides are expressed
+// relative to.
+const managedRoleKey = BuiltInRoleAdmin