chore: track version files, docs, web app split, scripts (missed commits from March work)

docs/rbac-matrix.md

@@ -0,0 +1,35 @@
+# INP2P Tenant RBAC Matrix
+
+## Access Context
+
+- `session/admin`：租户管理员
+- `session/operator`：租户操作员
+- `apikey`：租户 API key（机器访问）
+- `master`：系统级 token（禁止用于 tenant API）
+
+## Action Mapping
+
+| action | session/admin | session/operator | apikey |
+|---|---:|---:|---:|
+| `view` | ✅ | ✅ | ✅ |
+| `mutate_node_meta` (alias/ip) | ✅ | ✅ | ❌ |
+| `mutate_sdwan` | ✅ | ✅ | ❌ |
+| `mutate_connect` | ✅ | ✅ | ❌ |
+| `mutate_node_control` (apps push / kick) | ✅ | ✅ | ❌ |
+| `enroll_manage` (revoke enroll token) | ✅ | ❌ | ❌ |
+
+## Route Coverage (implemented)
+
+- `POST /api/v1/nodes/alias` -> `mutate_node_meta`
+- `POST /api/v1/nodes/ip` -> `mutate_node_meta`
+- `POST /api/v1/sdwan/edit` -> `mutate_sdwan`
+- `POST /api/v1/connect` -> `mutate_connect`
+- `POST /api/v1/nodes/apps` -> `mutate_node_control`
+- `POST /api/v1/nodes/kick` -> `mutate_node_control`
+- `POST /api/v1/enroll/consume/{id}?status=0|1` -> `enroll_manage`
+
+## Security Notes
+
+- `master` token is blocked by tenant middleware.
+- Enroll revoke path now requires tenant auth and `session/admin`.
+- WS login logs no longer print raw token values.