feat: 业务层 services + 领域层 domain

- 领域层 domain/rules.py：RBAC 判定规则纯函数（role/permission/scope），接口层守卫改调领域规则
- 业务层 services/task_service.py：统一任务状态机（grab/bid/deliver/win/review），修复 deliver 无状态预检缺陷
- rbac_opc 抢单/投标/交付改走 TaskService

app/api/routers/rbac_opc.py

@@ -168,10 +168,9 @@ async def opc_grab(
     db: Database = Depends(get_db),
     actor: dict = Depends(require_roles("opc_member")),
 ):
-    task = await db.tasks.get(task_id)
-    if task is None or task["status"] != "published" or task["mode"] != "grab":
-        raise HTTPException(status_code=400, detail="任务不可抢单")
-    updated = await db.tasks.set_status(task_id, "in_progress")
+    from ...services.task_service import TaskService
+
+    updated = await TaskService(db).grab(task_id, actor)
     await write_audit(db, action="task.grab", resource="task", resource_id=task_id,
                 detail=actor.get("username"), user=actor, request=request)
     return updated
@@ -185,11 +184,9 @@ async def opc_bid(
     db: Database = Depends(get_db),
     actor: dict = Depends(require_roles("opc_member")),
 ):
-    task = await db.tasks.get(task_id)
-    if task is None or task["status"] != "published" or task["mode"] != "bid":
-        raise HTTPException(status_code=400, detail="任务不可投标")
-    bid = await db.bids.create(task_id, actor["id"], actor.get("nickname") or actor["username"],
-                         req.quote, req.plan)
+    from ...services.task_service import TaskService
+
+    bid = await TaskService(db).bid(task_id, actor, req.quote, req.plan)
     await write_audit(db, action="task.bid", resource="bid", resource_id=bid["id"],
                 user=actor, request=request)
     return bid
@@ -202,9 +199,9 @@ async def opc_deliver(
     db: Database = Depends(get_db),
     actor: dict = Depends(require_roles("opc_member")),
 ):
-    updated = await db.tasks.set_status(task_id, "delivered")
-    if updated is None:
-        raise HTTPException(status_code=404, detail="Task not found")
+    from ...services.task_service import TaskService
+
+    updated = await TaskService(db).deliver(task_id, actor)
     await write_audit(db, action="task.deliver", resource="task", resource_id=task_id,
                 user=actor, request=request)
     return updated