补充分组管理入口和创建权限校验

允许管理员通过成员管理能力打开分组操作，并限制创建账号时的分组范围。

backend/controllers/user.go

@@ -132,6 +132,10 @@ func CreateUser(ctx *context.Context, w http.ResponseWriter, req *http.Request)
 		writeAccountGroupError(w, err)
 		return
 	}
+	if err := accountgroup.CheckWrite(tx, accountgroup.MembershipScopeGuard(ctx.UserID, ctx.EffectiveRole(), groupIDs)); err != nil {
+		writeAccountGroupError(w, err)
+		return
+	}
 	groupIDs, err = accountgroup.ValidateMembership(tx, user.EffectiveRole(), groupIDs)
 	if err != nil {
 		writeAccountGroupError(w, err)

frontend/src/views/components/UserManagement/UserManagement.vue

@@ -84,7 +84,7 @@
             </el-tag>
           </template>
         </el-table-column>
-        <el-table-column label="操作" align="right" :width="canManageGroups ? 126 : 68">
+        <el-table-column label="操作" align="right" :width="canManageMembership ? 126 : 68">
           <template #default="scope">
             <el-button
               size="small"
@@ -97,7 +97,7 @@
             >
               编辑
             </el-button>
-            <el-button v-if="canManageGroups" size="small" text :disabled="groupSaving" @click="editMembership(scope.row)">分组</el-button>
+            <el-button v-if="canManageMembership" size="small" text :disabled="groupSaving" @click="editMembership(scope.row)">分组</el-button>
           </template>
         </el-table-column>
       </el-table>
@@ -238,7 +238,7 @@
                 </el-tag>
               </div>
               <el-button
-                v-if="canManageGroups"
+                v-if="canManageMembership"
                 class="membership-manage-button"
                 type="primary"
                 plain
@@ -368,6 +368,7 @@ const {
   groupsLoading,
   groupsError,
   canManageGroups,
+  canManageMembership,
   groupSaving,
   membershipVisible,
   membershipUser,