feat(user): 用户认证状态/所属/账号类型 分类字段

- users 增: certification_status(uncertified|pending|certified|rejected)+certification_time, affiliation(independent|park)+park_id/park_name, account_type(opc_default|park_staff|platform_staff|provider|enterprise); alembic 0007
- repo: set_classification; _user_to_dict 含全部新字段; profile 返回认证/所属/账号类型
- admin: POST /admin/users/{id}/classification(认证/分类设置, action:user.manage) + UserClassificationRequest schema
- 迁移已应用, 导入通过

app/api/routers/auth.py

@@ -153,6 +153,11 @@ async def _profile_for(
     profile["compute_provisioned"] = bool(user.get("compute_provisioned", False))
     profile["compute_quota"] = user.get("compute_quota", 0)
     profile["compute_used_quota"] = user.get("compute_used_quota", 0)
+    profile["certification_status"] = user.get("certification_status", "uncertified")
+    profile["affiliation"] = user.get("affiliation", "independent")
+    profile["park_id"] = user.get("park_id", "")
+    profile["park_name"] = user.get("park_name", "")
+    profile["account_type"] = user.get("account_type", "opc_default")
     profile["role"] = role
     profile["sub_role"] = sub_role
     profile["org_id"] = org_id

app/api/routers/rbac_admin.py

@@ -6,7 +6,7 @@ from fastapi import APIRouter, Depends, HTTPException, Request
 from pydantic import BaseModel
 
 from ..dependencies import get_db
-from ..schemas.admin import SetUserRoleRequest, SetUserStatusRequest
+from ..schemas.admin import SetUserRoleRequest, SetUserStatusRequest, UserClassificationRequest
 from ..schemas.admin import UserCreateRequest, RolePermissionRequest, UpdateUserRequest
 from ...rbac import require_permission, require_roles, write_audit
 from ...infrastructure.repositories import Database
@@ -82,6 +82,23 @@ async def set_user_role(
     return {"ok": True, "user": await db.users.to_profile(updated)}
 
 
+@router.post("/users/{user_id}/classification", summary="设置用户认证状态/所属/账号类型")
+async def set_user_classification(
+    user_id: str,
+    req: UserClassificationRequest,
+    request: Request,
+    db: Database = Depends(get_db),
+    actor: dict = Depends(require_permission("action:user.manage")),
+):
+    fields = req.model_dump(exclude_none=True)
+    updated = await db.users.set_classification(user_id, **fields)
+    if updated is None:
+        raise HTTPException(status_code=404, detail="User not found")
+    await write_audit(db, action="user.classification", resource="user", resource_id=user_id,
+                detail=str(fields), user=actor, request=request)
+    return {"ok": True, "user": updated}
+
+
 @router.post("/users/{user_id}/status", summary="禁用/启用用户")
 async def set_user_status(
     user_id: str,

app/api/schemas/admin.py

@@ -9,6 +9,16 @@ class SetUserRoleRequest(BaseModel):
 class SetUserStatusRequest(BaseModel):
     status: str = "active"  # active | disabled
 
+
+class UserClassificationRequest(BaseModel):
+    """用户 认证状态/所属/账号类型 分类字段。"""
+    certification_status: str | None = None  # uncertified|pending|certified|rejected
+    certification_time: str | None = None
+    affiliation: str | None = None           # independent|park
+    park_id: str | None = None
+    park_name: str | None = None
+    account_type: str | None = None          # opc_default|park_staff|platform_staff|provider|enterprise
+
 class UpdateUserRequest(BaseModel):
     nickname: str | None = None
     role: str | None = None