feat: 业务层 services 抽取完成（工作台/用户管理）

- DashboardService：OPC 工作台聚合（统计/进行中任务/智能体建议/月度收入/消息）
- UserAdminService：建号+默认身份联动、角色分配提权防护（action:role.grant_perm 仅超管）
- rbac_opc dashboard / rbac_admin create_user+set_role 接线
- services 层覆盖全部核心业务域，路由全瘦身

app/api/routers/rbac_admin.py

@@ -50,22 +50,12 @@ async def create_user(
     db: Database = Depends(get_db),
     actor: dict = Depends(require_permission("action:user.assign_role")),
 ):
-    if not req.username.strip() or not req.password.strip():
-        raise HTTPException(status_code=400, detail="账号与密码必填")
-    if await db.users.get_by_username(req.username) is not None:
-        raise HTTPException(status_code=400, detail="账号已存在")
-    await _validate_role_assignment(db, actor, req.role, req.sub_role)
-    user = await db.users.create(
-        req.username, req.password, nickname=req.nickname,
-        role=req.role, sub_role=req.sub_role, org_id=req.org_id, region_id=req.region_id,
-    )
-    # 自动创建该账号的默认端口身份
-    await db.identities.create(user["id"], port=_port_for_role(req.role), role=req.role,
-                         sub_role=req.sub_role, org_id=req.org_id, region_id=req.region_id,
-                         name=req.nickname or req.username)
+    from ...services.user_admin_service import UserAdminService
+
+    user = await UserAdminService(db).create_user(req, actor)
     await write_audit(db, action="user.create", resource="user", resource_id=user["id"],
                 detail=f"role={req.role}", user=actor, request=request)
-    return await db.users.to_profile(user)
+    return user
 
 
 def _port_for_role(role: str) -> str:
@@ -94,11 +84,12 @@ async def set_user_role(
     db: Database = Depends(get_db),
     actor: dict = Depends(require_permission("action:user.assign_role")),
 ):
+    from ...services.user_admin_service import UserAdminService
+
     if await db.users.get_by_id(user_id) is None:
         raise HTTPException(status_code=404, detail="User not found")
-    await _validate_role_assignment(db, actor, req.role, req.sub_role)
-    updated = await db.users.set_role(
-        user_id, req.role, req.sub_role, req.org_id, req.region_id,
+    updated = await UserAdminService(db).set_user_role(
+        actor, user_id, req.role, req.sub_role, req.org_id, req.region_id,
     )
     await write_audit(
         db, action="role.assign", resource="user", resource_id=user_id,