feat: implement data capsule permission system

- Add atomic and molecular permission models based on 数据胶囊权属向量码 spec
- Create permission tables with position-based indexing for boolean vectors
- Implement 14 atomic permissions mapped to specific vector positions
- Implement 10 molecular permissions with boolean vectors matching permission matrix
- Add init_permissions binary for clean database initialization
- Remove legacy certificate and CA models (moved to separate service)
- Refactor user model to simplified structure

Breaking changes:
- Removed certificate-related tables and models
- Changed database initialization flow

Technical details:
- Atomic permissions use position (0-13) as SurrealDB record ID
- Molecular permissions store 14-element boolean vectors
- Position field ensures correct mapping between atomic and molecular permissions

Author: atlas-form

crates/capsula-bank/Cargo.toml

@@ -4,6 +4,7 @@ version = "0.1.0"
 edition = "2021"
 authors = ["ancient <gamesworldcraft@gmail.com>"]
 description = "Capsula Banking server with REST API"
+default-run = "capsula-bank"
 
 [dependencies]
 # Capsula crates

crates/capsula-bank/src/bin/init_permissions.rs

@@ -0,0 +1,67 @@
+/// 权限数据初始化程序
+///
+/// 用于初始化数据库中的默认权限数据
+/// 通常在以下情况下运行：
+/// 1. 首次部署系统
+/// 2. 需要重置权限数据到默认状态
+/// 3. 升级后需要更新权限定义
+///
+/// 使用方法：
+/// ```bash
+/// cargo run --bin init_permissions
+/// ```
+use capsula_bank::{
+    db::{create_tables, force_initialize_default_data, get_db, init_db},
+    settings::Settings,
+};
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    // 初始化日志
+    tracing_subscriber::fmt().with_target(false).init();
+
+    println!("========================================");
+    println!("    权限数据初始化程序");
+    println!("========================================\n");
+
+    // 加载配置
+    println!("📋 加载配置文件...");
+    let settings = Settings::load("config/services.toml")?;
+    println!("✅ 配置加载成功\n");
+
+    // 连接数据库
+    println!("🔌 连接数据库...");
+    println!(
+        "   Host: {}:{}",
+        settings.surrealdb.host, settings.surrealdb.port
+    );
+    println!("   Namespace: {}", settings.surrealdb.namespace);
+    println!("   Database: {}", settings.surrealdb.database);
+
+    init_db(settings.surrealdb).await?;
+    println!("✅ 数据库连接成功\n");
+
+    // 清理现有表
+    println!("🗑️ 清理现有表...");
+    let db = get_db();
+    db.query("REMOVE TABLE IF EXISTS molecular_permissions").await?;
+    db.query("REMOVE TABLE IF EXISTS atomic_permissions").await?;
+    println!("✅ 现有表已清理\n");
+
+    // 创建表结构
+    println!("📊 创建表结构...");
+    create_tables().await?;
+    println!("✅ 表结构创建成功\n");
+
+    // 初始化权限数据
+    println!("🔐 初始化权限数据...");
+    force_initialize_default_data().await?;
+
+    println!("\n========================================");
+    println!("✨ 权限数据初始化完成！");
+    println!("========================================");
+    println!("\n现在可以启动 Capsula Bank 服务器了：");
+    println!("cargo run");
+
+    Ok(())
+}

crates/capsula-bank/src/db/atomic_permissions.rs

@@ -0,0 +1,81 @@
+use crate::{
+    db::get_db,
+    error::Result,
+    models::permission::{get_default_atomic_permissions, AtomicPermission},
+};
+
+/// Create atomic permissions table - stores atomic permission definitions
+/// 原子权限表：存储原子权限的定义，主要用于文档和展示
+pub async fn create_atomic_permissions_table() -> Result<()> {
+    let query = r#"
+        -- ---------------------
+        -- 原子权限表定义
+        -- ---------------------
+        DEFINE TABLE IF NOT EXISTS atomic_permissions SCHEMAFULL;
+        
+        -- 字段定义
+        DEFINE FIELD IF NOT EXISTS atom_id              ON TABLE atomic_permissions TYPE string ASSERT $value != NONE AND $value != "";
+        DEFINE FIELD IF NOT EXISTS name                 ON TABLE atomic_permissions TYPE string;
+        DEFINE FIELD IF NOT EXISTS position             ON TABLE atomic_permissions TYPE int ASSERT $value >= 0 AND $value < 14;
+        DEFINE FIELD IF NOT EXISTS category             ON TABLE atomic_permissions TYPE string 
+            ASSERT $value IN ['read_edit', 'usage', 'transfer', 'supervision'];
+        DEFINE FIELD IF NOT EXISTS description          ON TABLE atomic_permissions TYPE string;
+        DEFINE FIELD IF NOT EXISTS created_at           ON TABLE atomic_permissions TYPE int DEFAULT time::unix();
+        DEFINE FIELD IF NOT EXISTS updated_at           ON TABLE atomic_permissions TYPE int DEFAULT time::unix();
+        
+        -- ---------------------
+        -- 索引定义
+        -- ---------------------
+        DEFINE INDEX IF NOT EXISTS atom_id_idx    ON TABLE atomic_permissions COLUMNS atom_id UNIQUE;
+        DEFINE INDEX IF NOT EXISTS position_idx   ON TABLE atomic_permissions COLUMNS position UNIQUE;
+        DEFINE INDEX IF NOT EXISTS category_idx   ON TABLE atomic_permissions COLUMNS category;
+    "#;
+
+    let db = get_db();
+    db.query(query).await?;
+    Ok(())
+}
+
+/// Initialize default atomic permissions using Rust code
+pub async fn initialize_atomic_permissions() -> Result<()> {
+    let db = get_db();
+
+    // 获取默认的原子权限列表
+    let permissions = get_default_atomic_permissions();
+
+    // 批量插入原子权限，使用 position 作为记录ID
+    for permission in permissions {
+        let _: Option<AtomicPermission> = db
+            .create(("atomic_permissions", permission.position as i64))
+            .content(permission)
+            .await?;
+    }
+
+    Ok(())
+}
+
+/// 查询所有原子权限
+#[allow(dead_code)]
+pub async fn get_all_atomic_permissions() -> Result<Vec<AtomicPermission>> {
+    let db = get_db();
+    let permissions: Vec<AtomicPermission> = db.select("atomic_permissions").await?;
+    Ok(permissions)
+}
+
+/// 根据位置查询原子权限
+#[allow(dead_code)]
+pub async fn get_atomic_permission_by_position(position: u8) -> Result<Option<AtomicPermission>> {
+    let db = get_db();
+    let permission: Option<AtomicPermission> = db.select(("atomic_permissions", position as i64)).await?;
+    Ok(permission)
+}
+
+/// 根据atom_id查询原子权限
+#[allow(dead_code)]
+pub async fn get_atomic_permission_by_atom_id(atom_id: &str) -> Result<Option<AtomicPermission>> {
+    let db = get_db();
+    let query = "SELECT * FROM atomic_permissions WHERE atom_id = $atom_id";
+    let mut response = db.query(query).bind(("atom_id", atom_id.to_string())).await?;
+    let permissions: Vec<AtomicPermission> = response.take(0)?;
+    Ok(permissions.into_iter().next())
+}