feat: add tag design

[earayu]

Note

Introduces a new design spec (docs/design/tag_based_permission_design_zh.md) for a tag-based grouping system enabling batch authorization without changing existing permission checks.

• Defines two new tables: tag and tag_relation; reuses user_collection_subscription for actual permissions
• Describes service flow (tag CRUD, tagging relations, batch grant service) and interaction with existing subscription logic
• Specifies REST APIs for tags, user/collection tagging, and batch grant/subscribe/revoke operations
• Details batch grant algorithm, caching and bulk-insert optimizations, and operation limits/auditing
• Provides DB migration DDL and phased deployment plan; notes future extensibility (documents/bots, templates, sync, approvals)

^{Written by Cursor Bugbot for commit c418241. This will update automatically on new commits. Configure here.}