feat: add tenant and user management with migrations, handlers, and tests

- Implemented tenant and user management features including:
  - Tenant creation and management with associated migrations.
  - User creation and management with associated migrations.
  - Tenant membership management with associated migrations.
  - Platform user roles management with associated migrations.
  - Quota management with associated migrations.
  - Article and template management with associated migrations.
- Added HTTP handlers for templates and workspaces.
- Created tests for protected and public routes.
- Introduced a script to check tenant scope in SQL queries.
- Documented task plan for backend completion and frontend foundation.

apps/admin-web/src/lib/errors.ts

@@ -0,0 +1,31 @@
+import { ApiClientError } from "@geo/http-client";
+
+const errorMessageMap: Record<string, string> = {
+  invalid_credentials: "邮箱或密码错误",
+  no_tenant: "当前账号未关联租户",
+  not_authenticated: "请先登录",
+  invalid_access_token: "登录状态已失效",
+  invalid_refresh_token: "刷新令牌已失效",
+  refresh_session_expired: "登录已过期，请重新登录",
+  refresh_token_mismatch: "刷新令牌校验失败，请重新登录",
+  token_revoked: "当前会话已经退出",
+  tenant_scope_missing: "租户上下文缺失",
+  query_failed: "数据读取失败",
+  quota_insufficient: "生成额度不足",
+  llm_unavailable: "生成服务不可用",
+  network_error: "网络连接失败，请稍后重试",
+  unknown_error: "发生未知错误",
+};
+
+export function formatError(error: unknown): string {
+  if (error instanceof ApiClientError) {
+    const message = errorMessageMap[error.message] ?? error.message.replaceAll("_", " ");
+    return error.detail ? `${message}: ${error.detail}` : message;
+  }
+
+  if (error instanceof Error) {
+    return error.message;
+  }
+
+  return "发生未知错误";
+}