feat(org): 成员目录 —— Keycloak 读写面穿透、治理台成员/组织/权限三页、姓在前 personName、Staff.kind

后端:`KeycloakDirectory` 端口(users / groups / roles 读写;写直接穿透 Keycloak —— 这里建的人立刻能登录、
删的人立刻消失,停用与收权之后 logout 踢掉会话)、`keycloak-directory.ts` + `keycloak-admin-http.ts` 适配器、
org-directory 契约与 /api/gov 路由、`sync-roster` CLI(ops 路由够不着时整册照过来),
容器按 provisioning 服务账号有无决定注不注入(没配就如实说不可用)。
`personName` 姓在前:汉字直拼「柴浩」、否则留一个空格「Admin Amy」,token 与名册同步两条路同一把尺;
`staffKindOf` 按 Keycloak 固定前缀 service-account- 认服务账号,员工那一屏不摆它(`Staff.kind` 不落库,按账号名现判)。
前端:员工那一屏重做成成员 / 组织 / 权限三页签(member-page 下钻),页签栏右端一句话说清这一格管什么。
契约变更:contracts org.ts / api/http.ts / api/org-directory.ts;api-report 已刷新;org CONTRACT.md 与 ADR-012 同步。
2026-08-26 做的,一直留在工作树没入库。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0167qWjeyBwvfdGovd7FWbCu

apps/web/src/shared/gov/gov-api.ts

@@ -23,6 +23,7 @@ import type {
   GovTriggersOutput,
   GovWorkGroupsOutput,
   GovWorkflowOutput,
+  RouteOutput,
   ProcessPackage,
   GovLedgerByActivityOutput,
 } from '@contracts';
@@ -44,6 +45,12 @@ import {
   listLlmInstancesRoute,
   listLlmProvidersRoute,
   listProcessPackagesRoute,
+  getOrgUserRoute,
+  listOrgGroupMembersRoute,
+  listOrgGroupsRoute,
+  listOrgRolesRoute,
+  listOrgUsersRoute,
+  listRoleAccessRoute,
   listStaffRoute,
   listToolsRoute,
   listTriggersRoute,
@@ -190,3 +197,65 @@ export const useGovWorkflow = (id: string): UseQueryResult<GovWorkflow> =>
 
 export const useGovTaskLog = (taskId: string): UseQueryResult<GovTaskLog> =>
   useQuery({ queryKey: ['gov', 'tasklog', taskId], queryFn: () => call<GovTaskLog>(govTaskLogRoute, { params: { taskId } }) });
+
+/* ── 成员与组织(ADR-012)———————————————————————————————————————— */
+
+/**
+ * 各屏的查询键 —— 写完**按碰到的那几屏**失效,别一把 `['gov','org']` 全清。
+ * 成员那一趟最贵(服务端要逐人问角色,见 debt),把它拖进来重取,
+ * 屏上那棵组织树就多钉着已经没了的组好几秒。
+ */
+export const ORG_KEYS = {
+  users: ['gov', 'org', 'users'] as const,
+  user: ['gov', 'org', 'user'] as const,
+  roles: ['gov', 'org', 'roles'] as const,
+  groups: ['gov', 'org', 'groups'] as const,
+  groupMembers: ['gov', 'org', 'group-members'] as const,
+  roleAccess: ['gov', 'org', 'role-access'] as const,
+};
+
+export type GovOrgUsers = RouteOutput<typeof listOrgUsersRoute>;
+export type GovOrgUserDetail = RouteOutput<typeof getOrgUserRoute>;
+export type GovOrgRoles = RouteOutput<typeof listOrgRolesRoute>;
+export type GovOrgGroups = RouteOutput<typeof listOrgGroupsRoute>;
+export type GovOrgGroupMembers = RouteOutput<typeof listOrgGroupMembersRoute>;
+export type GovRoleAccess = RouteOutput<typeof listRoleAccessRoute>;
+
+/**
+ * 成员列表 —— 检索与「含停用」都在**服务端**过滤(那边握着全量,前端只拿要摆的那些)。
+ * 服务端第一次取要几秒(Keycloak 没有批量取角色的口,见 debt),它自己有 60 秒缓存;
+ * 这边 `staleTime` 跟着设一档,免得同一屏的几个组件各要一遍。
+ */
+export const useOrgUsers = (q: string, includeDisabled: boolean): UseQueryResult<GovOrgUsers> =>
+  useQuery({
+    queryKey: ['gov', 'org', 'users', q, includeDisabled],
+    queryFn: () =>
+      call<GovOrgUsers>(listOrgUsersRoute, {
+        query: { q: q === '' ? undefined : q, includeDisabled: includeDisabled ? '1' : undefined },
+      }),
+    staleTime: 30_000,
+  });
+
+export const useOrgUser = (sub: string | undefined): UseQueryResult<GovOrgUserDetail> =>
+  useQuery({
+    queryKey: ['gov', 'org', 'user', sub],
+    queryFn: () => call<GovOrgUserDetail>(getOrgUserRoute, { params: { sub: sub! } }),
+    enabled: sub !== undefined,
+  });
+
+export const useOrgRoles = (): UseQueryResult<GovOrgRoles> =>
+  useQuery({ queryKey: ['gov', 'org', 'roles'], queryFn: () => call<GovOrgRoles>(listOrgRolesRoute), staleTime: 30_000 });
+
+export const useOrgGroups = (): UseQueryResult<GovOrgGroups> =>
+  useQuery({ queryKey: ['gov', 'org', 'groups'], queryFn: () => call<GovOrgGroups>(listOrgGroupsRoute), staleTime: 30_000 });
+
+export const useOrgGroupMembers = (groupId: string | undefined): UseQueryResult<GovOrgGroupMembers> =>
+  useQuery({
+    queryKey: ['gov', 'org', 'group-members', groupId],
+    queryFn: () => call<GovOrgGroupMembers>(listOrgGroupMembersRoute, { params: { id: groupId! } }),
+    enabled: groupId !== undefined,
+  });
+
+/** 角色 → 端 —— 这张表是**本地**的(ADR-012),不是 Keycloak 的字段 */
+export const useRoleAccess = (): UseQueryResult<GovRoleAccess> =>
+  useQuery({ queryKey: ['gov', 'org', 'role-access'], queryFn: () => call<GovRoleAccess>(listRoleAccessRoute) });