```

feat(auth): 添加用户权限获取接口并完善JWT令牌角色信息

- 在JWT令牌中添加用户角色信息
- 新增get_my_permissions接口用于获取当前用户权限码列表
- 重构认证回调逻辑，增加错误日志记录
- 更新用户信息获取接口使用Authorization头验证
```

backend/app/api/v1/users.py

@@ -0,0 +1,81 @@
+"""用户管理 API"""
+from fastapi import APIRouter, Depends, Query, HTTPException
+from sqlalchemy.orm import Session
+from sqlalchemy import asc
+
+from app.core.database import get_db
+from app.middleware.permission_middleware import require_permission
+from app.models.user import User
+from app.schemas.user import UserListResponse, UserListItem, UserRoleUpdate
+
+router = APIRouter(prefix="/api/users", tags=["用户管理"])
+
+VALID_ROLES = {'admin', 'area_admin', 'school_admin', 'user'}
+
+
+@router.get("", response_model=UserListResponse)
+def get_users(
+    skip: int = Query(0, ge=0),
+    limit: int = Query(20, ge=1, le=100),
+    role: str = None,
+    keyword: str = None,
+    db: Session = Depends(get_db),
+    _: dict = Depends(require_permission('user.view')),
+):
+    """获取用户列表"""
+    query = db.query(User)
+    if role:
+        query = query.filter(User.role == role)
+    if keyword:
+        query = query.filter(
+            User.username.contains(keyword) | User.email.contains(keyword)
+        )
+    query = query.order_by(asc(User.created_at))
+    total = query.count()
+    items = query.offset(skip).limit(limit).all()
+    return {"total": total, "items": items}
+
+
+@router.put("/{user_id}/role")
+def update_user_role(
+    user_id: int,
+    body: UserRoleUpdate,
+    db: Session = Depends(get_db),
+    current: dict = Depends(require_permission('user.manage')),
+):
+    """修改用户角色及分配区域/学校"""
+    if body.role not in VALID_ROLES:
+        raise HTTPException(status_code=400, detail=f"无效角色，可选：{', '.join(VALID_ROLES)}")
+
+    user = db.query(User).filter(User.id == user_id).first()
+    if not user:
+        raise HTTPException(status_code=404, detail="用户不存在")
+
+    # 不允许修改自己的角色
+    if str(user.id) == current.get('sub'):
+        raise HTTPException(status_code=400, detail="不能修改自己的角色")
+
+    user.role = body.role
+    user.assigned_area = body.assigned_area
+    user.assigned_school = body.assigned_school
+    db.commit()
+    return {"message": "更新成功"}
+
+
+@router.put("/{user_id}/toggle")
+def toggle_user(
+    user_id: int,
+    db: Session = Depends(get_db),
+    current: dict = Depends(require_permission('user.manage')),
+):
+    """启用/禁用用户"""
+    user = db.query(User).filter(User.id == user_id).first()
+    if not user:
+        raise HTTPException(status_code=404, detail="用户不存在")
+
+    if str(user.id) == current.get('sub'):
+        raise HTTPException(status_code=400, detail="不能禁用自己")
+
+    user.is_active = not user.is_active
+    db.commit()
+    return {"message": "已禁用" if not user.is_active else "已启用", "is_active": user.is_active}