feat: Z38 grant Yuheng agents ready-to-use access

Complete permissions during every bind and token path, expose effective access in the console, and keep the platform return path globally available.

Co-authored-by: Cursor <cursoragent@cursor.com>

platform/internal/logic/applogic/agents.go

@@ -255,6 +255,15 @@ func (l *AuthLogic) IssueClientCredentials(clientID, clientSecret string) (*type
 			}
 		}
 	}
+	// Z38：宇恒已绑定账号用 client_credentials 换票时自动修复存量缺权。
+	if strings.TrimSpace(acc.HostKey) != "" &&
+		strings.TrimSpace(acc.ChannelID) != "" &&
+		strings.TrimSpace(acc.OnlineDBID) != "" {
+		acc, err = l.ensureYuhengAgentPerms(acc)
+		if err != nil {
+			return nil, err
+		}
+	}
 	token, exp, err := authx.IssueAgentToken(l.svcCtx.JWT, acc.TenantID, acc.AgentID, acc.Perms)
 	if err != nil {
 		return nil, err